---
title: Client IP Validation Mode
description: For each authenticated request from a named web application, check that the IP address of the request satisfies one of the following acceptance criteria:
component: java-agents
version: 2025.11
page_id: java-agents:properties-reference:org.forgerock.agents.original.ip.check.mode.map
canonical_url: https://docs.pingidentity.com/java-agents/2025.11/properties-reference/org.forgerock.agents.original.ip.check.mode.map.html
---

# Client IP Validation Mode

For each authenticated request from a named web application, check that the IP address of the request satisfies one of the following acceptance criteria:

* It originates from the IP address used for first authentication.

* It has acceptable changes only, as mapped in [Client IP Validation Address Map](org.forgerock.agents.acceptable.ip.address.map.html)

* If the web application is not named, check the the IP address globally, for all web applications.

|                          |                                                                                                                                                                                                                                                                                             |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Property name            | `org.forgerock.agents.original.ip.check.mode.map`                                                                                                                                                                                                                                           |
| Aliases                  | `org.forgerock.agents.original.ip.check.mode.map`   Introduced in Java Agent 5.8.0   [Recognized](preface.html#how_am_manages_multiple_aliases) from AM 7.1                                                                                                                                 |
| Function                 | Client identification                                                                                                                                                                                                                                                                       |
| Supported settings       | - OFF

  IP address checking is disabled.

- DENY

  An "unacceptable" IP address change triggers an HTTP 403 response.

- LOGOUT

  An "unacceptable" IP address change causes the agent to invalidate the user token by calling the logout endpoint in AM and killing the user's cookies. |
| Default                  | `OFF`                                                                                                                                                                                                                                                                                       |
| Bootstrap property       | No                                                                                                                                                                                                                                                                                          |
| Required property        | No                                                                                                                                                                                                                                                                                          |
| Restart required         | No                                                                                                                                                                                                                                                                                          |
| Local configuration file | `AgentConfig.properties`                                                                                                                                                                                                                                                                    |
| AM console               | Tab: `Application (from AM 7.1)`Title: `Client IP Validation Mode`                                                                                                                                                                                                                          |