Error message: Client address x.x.x.x invalid for session ... bound to y.y.y.y

[Vincent Feyaerts]

I did some more checking, and all the users with his error logged in on the
old Shib3 environment this morning. So this makes sense: they present their
existing session to Shib IDP4, which doesn't like it because it's bound to
the wrong IP. 

The reason seems to be that my Jetty config is different, that will probably
be the cause. Instead of adding X-Forwarded-For as a seperate value,
idp.remote_addr is now the real IP of the client.  Therefore, Shibboleth
knows the real ip as well.

If my conclusion is correct, my security is now way better with this new
config than before, when all my sessions used to be bound to one IP, the
load balancer.

Case closed I think!

Kind regards
Vincent


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Vincent Feyaerts
Sent: woensdag 31 maart 2021 15:43
To: Shib Users <users at shibboleth.net>
Subject: RE: Error message: Client address x.x.x.x invalid for session ...
bound to y.y.y.y

CAUTION: This email originated from outside of the organization. Do not
click links or open attachments unless you recognize the sender and know the
content is safe.


Hi all,

I have a similar issue with my IdP4.1. This problem didn't occur on IdP3,
which has the exact load balancer config. It's the same hardware
loadbalancer, a F5 Big-IP.

Example of the error, my logs are full of them.

2021-03-31 12:04:35,551 - 143.129.120.126 - WARN
[net.shibboleth.idp.session.impl.StorageBackedIdPSession:115] - Client
address [real_external_ip] invalid for session ..... bound to
[load_balancer_ip]
2021-03-31 12:04:39,249 - 143.129.120.126 - INFO
[net.shibboleth.idp.authn.impl.LDAPCredentialValidator:163] - Credential
Validator ldap: Login by '...' succeeded

Our load balancer and back-ends have real IP, so the back-end don't have a
route back trough the load balancer. Therefore, the client IP on the IdP, on
TCP level, is always the load balancer. I don't know where Shib can get the
real_external_ip from?

I adapted my Jetty to log X-Forwarded-For, but Shib ignores this I think.

So sessions are bound to an IP, I would expect that they are always bound to
the load balancer IP. Don't we lose all the security this way? I mean, if
the cookie were to be compromised, the attacker could just go with his own
IP trough the LB, and be able to use the cookie.

Could these errors happen because I changed the back-ends from my Shib Idp
front-end to SHIB4 instead of SHIB3, and they present a session from SHIB3?
If that were the case, are there changes in SHIB4 in that it now knows the
real ip of the client (real_external_ip) instead of the load_balancer_ip?

Sorry for the many questions, I'm a bit puzzled about it.

Thanks
Vincent


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: dinsdag 16 maart 2021 18:49
To: Shib Users <users at shibboleth.net>
Subject: RE: Error message: Client address x.x.x.x invalid for session ...
bound to y.y.y.y

CAUTION: This email originated from outside of the organization. Do not
click links or open attachments unless you recognize the sender and know the
content is safe.


> It's likely that your LBs aren't passing the remote address of the 
> client when they transit the proxy.

That would tend to prevent the warning altogether as all the sessions will
be bound to a fixed address., but it definitely has nothing to do with
cookie problems that lead to flow execution errors.

-- Scott

--
For Consortium Member technical support, see
https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibb
oleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Cvincent.feyaerts%40ua
ntwerpen.be%7C6a7de81cbd8c46bf791a08d8e8a3c814%7C792e08fb2d544a8eaf722025481
36ef6%7C0%7C0%7C637515137440414867%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwM
DAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=JzbIqyp34
9BOwK2rjhokFEyX7uuvBK9H%2F%2BQYEjIW19c%3D&reserved=0
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6855 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20210331/53790b85/attachment.p7s>