<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">We’ve recently protected a web application in a testing environment with Shibboleth SP 2.6. It’s a very standard deployment, but now I’ve been asked to allow non-user communication from another component of the application coming from a
remote server, and essentially allow that to bypass authentication. The remote server needs to make calls to the application through the protected URL.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is the first time I’ve encountered this use case, so I’m unfamiliar with the options. It doesn’t seem possible to create a configuration to actually bypass authentication, so I assume we need to look for options to provide some form
of automated authentication. Based on what I’ve read in the wiki documentation thus far, it seems we could configure IP-based authentication using conf/authn/ipaddress-authn-config.xml, or perhaps x509 authentication using conf/authn/x509-authn-config.xml.
I also read with interest a post to this list in Oct 2016 where Scott referred to attribute release based on IP address.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My initial question is how best to approach the problem where an external web app requires automated access to a protected URL, but where users also require password authentication. Should this be done by the IdP, or is it actually possible
to essentially whitelist a host at the SP based on source IP address? I’d definitely like to keep this as simple and straightforward as possible.
<o:p></o:p></p>
</div>
</body>
</html>