<p>Thank you for the hint Ian, but IdPAuthIP is not the solution because the SP expects to receive attributes so username/password authentication is a must. Firewalling is not an option because other SPs dont have this IP restriction.<br>
We need - prior to authentication - a check done by the IdP on browser IP and SP being accessed.<br>
Any help here would be greatly appreciated.<br>
Stefano<br>
</p>
<div class="gmail_quote">Il giorno 21/ago/2013 23:56, "Ian Rifkin" <<a href="mailto:irifkin@brandeis.edu">irifkin@brandeis.edu</a>> ha scritto:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div><div>Hi Stefano,<br><br><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>we need to limit access to a given SP<span></span> to users within a given IP range.</div>
<div>We can only work on the IdP side.<br></div></blockquote></div><br></div><div class="gmail_extra">I'm not an expert, so maybe someone else can chime in, but I think it would depend on your configuration. You can put IP restrictions in webserver and firewall software, but you can't do that if you use the IdP for other SPs that don't have this IP restriction. If you have a custom auth piece it looks like you can read about <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthIP" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthIP</a>. Or perhaps attempt something more fancy/custom.<br>
</div><br></div>Taking a step back, how do you currently do authentication? And what does the SP expect to receive back from you (do they do any authorization or does the SP just assume if they get a reply they are good?).<br>
<br></div><div>Regards,<br>Ian<br></div></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div>