Verification of SubjectLocality by the SAML extension
I'am using the SAML Extension in our web application and it's usually working very well.
A few days ago we had to authenticate against a new Shibboleth Identity Provider that is externally provided.
This provider sends an AuthnStatement including a SubjectLocality like
Code:
<saml2:AuthnStatement AuthnInstant="2011-02-01T11:05:56.628Z" SessionIndex="..." xmlns:saml2="ur
n:oasis:names:tc:SAML:2.0:assertion">
<saml2:SubjectLocality Address="10.10.0.30"/>
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Pass
wordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
In this case the authentication did not work because the WebSSOProfileConsumerImpl.verifyAuthenticationStat ement() fails in
Code:
if (auth.getSubjectLocality() != null) {
HTTPInTransport httpInTransport = (HTTPInTransport) context.getInboundMessageTransport();
if (auth.getSubjectLocality().getAddress() != null) {
if (!httpInTransport.getPeerAddress().equals(auth.getSubjectLocality().getAddress())) {
throw new BadCredentialsException("User is accessing the service from invalid address");
}
}
}
In my case auth.getSubjectLocality().getAddress() = 10.10.0.30 and httpInTransport.getPeerAddress() = <IP of my client pc> and these two IP's are not equal. 10.10.0.30 seems to be a private address in the system of the IDP and the other address is from my client PC. These two can never match.
I wonder if the IDP has a faulty setup or if the validation function of the SAML library makes a wrong assumption.
Unfortunately the oasis documentation only has a very brief description for the SubjectLocality and it does not tell me what address should be used here.
I would appreciate any comment on this matter.
