SP Address Checking From Web Server as Source

[Steven Teixeira]

Is it possible to avoid address checking mismatches in the Shibboleth SP for requests to a web application from the web server itself?

We have a .NET 8 Blazor web application that, as the developer describes: "This was caused by creating the hybrid mode Blazor app.  If it's just a Blazor Server app, I'd do all data access with EF core from the Blazor page (which doesn't cause any problems with Shibboleth).  If it's just a Blazor Webassembly app, I'd do all data access over an API call but they would all come from the browser (which again doesn't cause any problems with Shibboleth).  In hybrid mode, a page could run from the server or from the browser.  Instead of creating two different ways to access the data depending on where it's running from, I run everything through the API calls.  Which means when the page is running on the server, the API call is actually coming from the server instead of the user's browser."

I can see the address mismatch in the logs, with the client being the web server IP address, and the session IP address set to the machine on the network of the user that originally logged in.  I've tried excluding the API endpoint under the application from requiring a session, but the issue still persists.  It may be because .NET Core is now agnostic and the directories are more logical/virtual within the app and not physical directories on the web server.  I've looked at the unreliableNetworks attribute for the SessionCache element in hopes of not having to turn off address checking completely, but can't seem to make that work.  I'm also wondering if I even understand the purpose of the unreliableNetworks attribute, as that seems to not be relevant to requests coming from the web server itself.

Has anyone dealt with something like this, or know of something that I've missed that I should be configuring instead of what I've already tried?

Steven Teixeira
Application and Database Administrator
Office of Information Technology, Information Services
CSU Stanislaus
One University Circle
Turlock,CA 95382
209.667.3944
www.csustan.edu

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250220/10948e87/attachment.htm>