<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Thanks. And yes, I will have to do quite a bit of proxy testing and validation before I can consider this adequately secure to justify the convenience, and even so I recognize it's a bit less secure. </p>
<p><br>
</p>
<p>-- Jeff</p>
<p><br>
</p>
<p><br>
</p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Tuesday, June 13, 2017 1:24:49 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: IDP 3.3 - MFA Conditional via IP Address</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On 6/13/17, 1:15 PM, "users on behalf of Krug, Jeff" <users-bounces@shibboleth.net on behalf of Jeff.Krug@gtri.gatech.edu> wrote:<br>
<br>
> I am using IDP 3.3 to do MFA with a custom second factor I wrote, but I want to also make the use of the 2nd factor optional<br>
> depending on the IP Address of the user (I have it conditional based on whether they have a 2nd factor configured or not; that<br>
> was easy to do based on the attribute lookup example). <br>
<br>
Inject an instance of shibboleth.HttpServletRequest as a custom object into your scripted function.<br>
<br>
If you want something fancier, there's already an IPRangePredicate implemented that you could instantiate and use to take most of the work off you. It's used inside the access-control layer so there are examples of the wiring there.<br>
<br>
I'd caution that a lot of proxied/load-balanced deployments are probably not providing the address safely (and you're trying to use it for a security control, that's why I mention it).<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font>
</body>
</html>