Supporting change of IP address during Shibboleth sessions

[Max Spicer]

We are seeing increasing instances of clients having to log in to
Shibboleth again following a change of IP address. This happens for example
when a client roams between wifi and mobile data connections, changes from
4G to 5G, connects to our VPN etc. The net result is that users no longer
experience a single sign-on experience and this is causing complaints about
our Shibboleth implementation.

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631620/SessionConfiguration
states "IdP sessions are by default bound to an "address" in order to
prevent trivial session takeover simply through session cookie exposure.
This can be disabled via the Idp.session.consistentAddress property or
relaxed in various ways through the idp.session.consistentAddressCondition
extension point. It is deeply ill-advised to simply disable this checking
entirely and it is deeply unsafe to operate networks that hide a plethora
of clients behind a single address."

We could potentially implement a consistentAddressCondition that allows IP
addresses to roam to trusted subnets. This would presumably allow a session
to be maintained when connecting to our VPNs. I'm not sure what we could do
about clients roaming between Wifi and mobile data etc.

I wondered what others have done to mitigate such situations and also if
anyone could expand further on the risks of disabling consistent address
checking entirely if cookies are only ever transmitted over SSL.

I'd appreciate any thoughts and comments to help us plan our approach.

Thanks,

Max Spicer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220322/86779ecb/attachment.htm>