PingFederate Server

Configuring the CIDR Authentication Selector

The CIDR Authentication Selector enables PingFederate to choose configured authentication sources or other selectors based on the IP address of an incoming single sign-on request.

About this task

Use this selector in authentication policies to choose from authentication sources that share a similar level of assurance, such as among multiple HTML Form Adapter instances or between a Kerberos Adapter instance and an X.509 identity provider (IdP) Adapter instance. For example, use this selector in authentication policies to route internal requests to a Kerberos Adapter instance.

Steps

  1. Go to Authentication → Policies → Selectors to open the Selectors window.

  2. On the Selectors window, click Create New Instance to start the Create Authentication Selector Instance workflow.

  3. On the Type tab, configure the basics of this authentication selector instance.

  4. On the Authentication Selector tab, click Add a new row to 'Networks' and enter a network range. Click Update.

    To see the Add a new row to 'Networks'option, ensure you have set the Authentication Selector Instance type to CIDR Authentication Selectoron the Type tab.

    Example:

    Sample IPv4 network range

    Enter 192.168.101.0/24 to cover 256 IPv4 addresses, ranging from 192.168.101.0 through 192.168.101.255.

    Sample IPv6 network range

    Enter 2001:db8::/123 to cover 32 IPv6 addresses, ranging from 2001:db8:: through 2001:db8::1f.

  5. Optional: Repeat the previous step to add more network ranges.

    Display order does not matter.

    If you want to include all IPv4 addresses for testing, add two separate ranges: 0.0.0.0/1 and 128.0.0.0/1. The CIDR Authentication Selector interprets a specification of 0.0.0.0/0 as an empty range rather than as a wildcard for all addresses.

    Click Edit, Update, or Cancel to make or undo a change to an existing entry. Click Delete or Undelete to remove an existing entry or cancel the removal request.

  6. Optional: Enter a Result Attribute Name value.

    This field provides a means to indicate in the SAML assertion whether a network range was matched during processing; the value is either Yes or No. Any authentication sources configured as a result of this authentication selector must have their attribute contract extended with the value of the Result Attribute Name field to use its value to fulfill an attribute contract or for issuance criteria.

    Complete the configuration.On the Summary tab, click Done.On the Selectors window, click Save.

Result

When you place this selector instance as a checkpoint in an authentication policy, it forms two policy paths: Yes and No. If the IP address of an incoming single sign-on (SSO) request matches one of the defined network ranges, the selector returns true. The policy engine regains control of the request and proceeds with the policy path configured for the result value of Yes. If the IP address of an incoming SSO request matches none of the defined network ranges, the selector returns false. The policy engine regains control of the request and proceeds with the policy path configured for the result value of No.