The CIDR Authentication Selector enables PingFederate to choose configured authentication sources or other selectors based on the IP address of an incoming single sign-on request.
Use this selector in authentication policies to choose from authentication sources that share a similar level of assurance, such as among multiple HTML Form Adapter instances or between a Kerberos Adapter instance and an X.509 identity provider (IdP) Adapter instance. For example, use this selector in authentication policies to route internal requests to a Kerberos Adapter instance.
- Go to Selectors window. to open the
- On the Selectors window, click Create New Instance to start the Create Authentication Selector Instance workflow.
- On the Type tab, configure the basics of this authentication selector instance.
On the Authentication Selector tab, click Add a
new row to 'Networks' and enter a network range. Click
To see the Add a new row to 'Networks' option, ensure you have set the Authentication Selector Instance type to CIDR Authentication Selector on the Type tab.
- Sample IPv4 network range
192.168.101.0/24to cover 256 IPv4 addresses, ranging from
- Sample IPv6 network range
2001:db8::/123to cover 32 IPv6 addresses, ranging from
Repeat the previous step to add more network ranges.
Note: Display order does not matter.Tip:
If you want to include all IPv4 addresses for testing, add two separate ranges:
220.127.116.11/1. The CIDR Authentication Selector interprets a specification of
0.0.0.0/0as an empty range rather than as a wildcard for all addresses.
Click Edit, Update, or Cancel to make or undo a change to an existing entry. Click Delete or Undelete to remove an existing entry or cancel the removal request.
Enter a Result Attribute Name value.
This field provides a means to indicate in the SAML assertion whether a network range was matched during processing; the value is either
No. Any authentication sources configured as a result of this authentication selector must have their attribute contract extended with the value of the Result Attribute Name field in order to use its value to fulfill an attribute contract or for issuance criteria.
Complete the configuration.
- On the Summary tab, click Done.
- On the Selectors window, click Save.
When you place this selector instance as a checkpoint in an authentication policy, it forms two policy paths: Yes and No. If the IP address of an incoming single sign-on (SSO) request matches one of the defined network ranges, the selector returns true. The policy engine regains control of the request and proceeds with the policy path configured for the result value of Yes. If the IP address of an incoming SSO request matches none of the defined network ranges, the selector returns false. The policy engine regains control of the request and proceeds with the policy path configured for the result value of No.