Can any one tell me where does POP get information about Network (provided in IP Auth)?

As I created a POP as:

Network: any other network
Authentication Level: forbidden

Network: 192.168.10.12
Mask: 255.255.255.255
Authentication Level: 0

Case I: When I access the WebSEAL directly from IP Address: (192.168.10.12); above policy allows me to access the protected resource and denies the access from other networks.

Case II: But when I access the WebSEAL put behind the FELB (Security Access Manager's).
Above created POP denies the access to protected resource from all IP addresses even (192.168.10.12).

------------------------------
Muhammad Talha
------------------------------

Muhammad,

The POP check is completed based on the IP address which is contained in the user credential.  As you have already probably worked out, the IP address in the credential is obtained at authentication time based on the client IP address.  If you are using a layer-7 load balancer it does mean that the client IP address is the IP address of the load balancer and not the 'real' client - which is why Case II is not working.  We have an outstanding RFE to allow WebSEAL to use the X-Forwarded-For header as the IP address - but this hasn't reached the top of the list just yet.

Thanks.

------------------------------
Scott Exton
IBM
Gold Coast
------------------------------

Thanks Scott,

I understand that the POP checks the IP address obtained from user credential.

Can we add XFF header in the user credential?

Yes, I am using Layer 7 Load Balancer and also configured it to forward XFF. So if we can configure XFF to be added in User Credential, POP can read form it. right?

------------------------------
Muhammad Talha
------------------------------

Original Message:
Sent: Thu June 20, 2019 03:57 PM
From: Scott Exton
Subject: IP Auth in Protected Object Policy

Muhammad,

The POP check is completed based on the IP address which is contained in the user credential.  As you have already probably worked out, the IP address in the credential is obtained at authentication time based on the client IP address.  If you are using a layer-7 load balancer it does mean that the client IP address is the IP address of the load balancer and not the 'real' client - which is why Case II is not working.  We have an outstanding RFE to allow WebSEAL to use the X-Forwarded-For header as the IP address - but this hasn't reached the top of the list just yet.

Thanks.

------------------------------
Scott Exton
IBM
Gold Coast
------------------------------