<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="FI" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hello all,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US">We have recently seen a few cases where the client side (browser) ip address changes on almost all requests. Obviously this prevents shibboleth idp from working, because client address is checked. However, the check causes
weird stuff to happen: the idp lets the login go on to the sp, but without any attributes (in this case, eppn, cn and mail but it’s irrelevant) except a static attribute that is unconditionally given to all (we have a local “logout url” parameter in the Finnish
Haka federation).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">log entries in process log are like this:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">x:x:x.x - ERROR [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:x] - Client sent a cookie from address x.x.x.33 but the cookie was issued to address x.x.x.38<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">(so, the code printing this is at <a href="http://svn.shibboleth.net/view/java-shib-idp2/tags/2.3.8/src/main/java/edu/internet2/middleware/shibboleth/idp/session/IdPSessionFilter.java?revision=3115&view=markup#l182">
http://svn.shibboleth.net/view/java-shib-idp2/tags/2.3.8/src/main/java/edu/internet2/middleware/shibboleth/idp/session/IdPSessionFilter.java?revision=3115&view=markup#l182</a> )<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Any advice on how to deal with this?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The current behavior is unacceptable, as the various SP’s don’t quite know what to do with a situation where they get a successful login without any attributes they need. I’d rather the idp to issue an error to the user,
and not let the user proceed to SP.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">For the record, we are also using the uApprove plugin.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:FI">-- <o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:FI">Viljo Viitanen<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:FI">University of Jyväskylä<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>