Yes, you can, but you don't take it from the request header but from the user credential. I don't think you have access to the request header. So you can of course only get it for an endpoint where the user is authenticated like the /authorization. If you put the ip in the attributes of the token you can also access it later, but it will only be the ip of the user which requested the authorization and not for example the ip of a client which will later request a token.
You can find everything you can use in the stsuu so it is always a good idea to log it when developing a mapping policy:
IDMappingExtUtils.traceString("\nstsuu:\n"+stsuu);
In the stsuu you will find the ip in the credential of the authenticated user:
<stsuuser:Attribute name="AZN_CRED_NETWORK_ADDRESS_STR" type="urn:ibm:names:ITFIM:5.1:accessmanager">
<stsuuser:Value>x.x.x.x</stsuuser:Value>
</stsuuser:Attribute>
To get the ip from the stsuu:
var ip = stsuu.getAttributeContainer().getAttributeValueByNameAndType("AZN_CRED_NETWORK_ADDRESS_STR", "urn:ibm:names:ITFIM:5.1:accessmanager");
But in your question you write specifically about the "client". I'm afraid in this case you won't be able to get the ip address as there is no WebSEAL credential.
------------------------------
Laurent LA Asselborn
------------------------------