<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Is it possible to avoid address checking mismatches in the Shibboleth SP for requests to a web application from the web server itself?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We have a .NET 8 Blazor web application that, as the developer describes: “This was caused by creating the hybrid mode Blazor app. If it's just a Blazor Server app, I'd do all data access with EF core from the Blazor page (which doesn't
cause any problems with Shibboleth). If it's just a Blazor Webassembly app, I'd do all data access over an API call but they would all come from the browser (which again doesn't cause any problems with Shibboleth). In hybrid mode, a page could run from the
server or from the browser. Instead of creating two different ways to access the data depending on where it's running from, I run everything through the API calls. Which means when the page is running on the server, the API call is actually coming from the
server instead of the user's browser.”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I can see the address mismatch in the logs, with the client being the web server IP address, and the session IP address set to the machine on the network of the user that originally logged in. I’ve tried excluding the API endpoint under
the application from requiring a session, but the issue still persists. It may be because .NET Core is now agnostic and the directories are more logical/virtual within the app and not physical directories on the web server. I’ve looked at the unreliableNetworks
attribute for the SessionCache element in hopes of not having to turn off address checking completely, but can’t seem to make that work. I’m also wondering if I even understand the purpose of the unreliableNetworks attribute, as that seems to not be relevant
to requests coming from the web server itself.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Has anyone dealt with something like this, or know of something that I’ve missed that I should be configuring instead of what I’ve already tried?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-ligatures:none">Steven Teixeira<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-ligatures:none">Application and Database Administrator<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-ligatures:none">Office of Information Technology, Information Services<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-ligatures:none">CSU Stanislaus<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-ligatures:none">One University Circle<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-ligatures:none">Turlock,CA 95382<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-ligatures:none">209.667.3944<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-ligatures:none"><a href="www.csustan.edu"><span style="color:#0563C1">www.csustan.edu</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>