<div dir="ltr">If it's sufficient to save the browser, rather than the IP address, our approach in our OTP module is to store a cookie, using the IdP's own cookie management tools. It's nice not having to worry about backend storage. (The downside is, it's Shibboleth-only, and some users get confused about the connection between this and their desktop MFA logins.)<div><br></div><div>Greg</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Sep 29, 2021 at 7:56 AM Arnaud Houdelette <<a href="mailto:arnaud.houdelette@normandie-univ.fr">arnaud.houdelette@normandie-univ.fr</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<p>Hi there. <br>
</p>
<p>I'm currently in the process of enabling MFA for our institution
(on IDP 4.1).<br>
</p>
<p>To limit the hassle on my 'angry' users, i'd like to ask for
second factor only when the connecting IP address is not on a
dynamic (expiring) allowlist.</p>
<p>I already found how to use a static whitelist with
conf/authn/mfa-authn-config.xml checkSecondFactor script. <br>
</p>
<p>I intend to load the address list from a database (sqlite) with
the attribute resolver... <br>
</p>
<p>but where in the auth process should I write the sucessful login
IP in the database ? <br>
</p>
<p><br>
</p>
<pre cols="72">--
Arnaud Houdelette
Administrateur des infrastructures systèmes et réseaux
Normandie Université</pre>
<div id="gmail-m_7556232107654274481grammalecte_menu_main_button_shadow_host" style="width:0px;height:0px"></div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>