Error message: Client address x.x.x.x invalid for session ... bound to y.y.y.y

[Vincent Feyaerts]

Hi all,

I have a similar issue with my IdP4.1. This problem didn't occur on IdP3,
which has the exact load balancer config. It's the same hardware
loadbalancer, a F5 Big-IP.

Example of the error, my logs are full of them.

2021-03-31 12:04:35,551 - 143.129.120.126 - WARN
[net.shibboleth.idp.session.impl.StorageBackedIdPSession:115] - Client
address [real_external_ip] invalid for session ..... bound to
[load_balancer_ip]
2021-03-31 12:04:39,249 - 143.129.120.126 - INFO
[net.shibboleth.idp.authn.impl.LDAPCredentialValidator:163] - Credential
Validator ldap: Login by '...' succeeded

Our load balancer and back-ends have real IP, so the back-end don't have a
route back trough the load balancer. Therefore, the client IP on the IdP, on
TCP level, is always the load balancer. I don't know where Shib can get the
real_external_ip from?

I adapted my Jetty to log X-Forwarded-For, but Shib ignores this I think.

So sessions are bound to an IP, I would expect that they are always bound to
the load balancer IP. Don't we lose all the security this way? I mean, if
the cookie were to be compromised, the attacker could just go with his own
IP trough the LB, and be able to use the cookie.

Could these errors happen because I changed the back-ends from my Shib Idp
front-end to SHIB4 instead of SHIB3, and they present a session from SHIB3?
If that were the case, are there changes in SHIB4 in that it now knows the
real ip of the client (real_external_ip) instead of the load_balancer_ip?

Sorry for the many questions, I'm a bit puzzled about it.

Thanks
Vincent


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: dinsdag 16 maart 2021 18:49
To: Shib Users <users at shibboleth.net>
Subject: RE: Error message: Client address x.x.x.x invalid for session ...
bound to y.y.y.y

CAUTION: This email originated from outside of the organization. Do not
click links or open attachments unless you recognize the sender and know the
content is safe.


> It's likely that your LBs aren't passing the remote address of the 
> client when they transit the proxy.

That would tend to prevent the warning altogether as all the sessions will
be bound to a fixed address., but it definitely has nothing to do with
cookie problems that lead to flow execution errors.

-- Scott

--
For Consortium Member technical support, see
https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibb
oleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Cvincent.feyaerts%40ua
ntwerpen.be%7C6a7de81cbd8c46bf791a08d8e8a3c814%7C792e08fb2d544a8eaf722025481
36ef6%7C0%7C0%7C637515137440414867%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwM
DAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=JzbIqyp34
9BOwK2rjhokFEyX7uuvBK9H%2F%2BQYEjIW19c%3D&reserved=0
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6855 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20210331/68863d76/attachment.p7s>