Shibboleth Developers

[Ian Young <>]

RL 'Bob' Morgan wrote:

> We have a campus-wide "internal network" service, for machines that 
> don't want to be on the big bad Internet, and a campus-wide NAT that 
> serves them all.  So for one of these machines our IdP sees the internal 
> address, but an off-campus SP sees the NAT address.  So we pretty much 
> have to ask all our SPs to turn off address checking.  I think this kind 
> of setup is unfortunately becoming pretty common.

Just as a reminder, I have some code for the IdP that handles this 
particular case (IdP and some set of SPs behind a NAT) by rewriting the 
client's IP before sending it to an SP that is outside the NAT.

There was a bit of a deafening silence around this last time round, but 
if people are interested, I could try reintegrating that with CVS HEAD 
again.

        -- Ian

P.S. No, my code doesn't handle IPv6...