4 ms·
Authenticating the source IP address on the fly (as detected from the browser) is definitely not the way to go for many reasons: 1. With NAT and metropolitan a
by sscarduzio 7y ago
Authenticating the source IP address on the fly (as detected from the browser) is definitely not the way to go for many reasons:
1. With NAT and metropolitan area networks, hundreds of thousands of devices could share the same public IP.
2. Large networks with many devices often connect to the public network through trunking (load balance the connections through multiple routers), so the HTTP connection between OKTA and my browser can VERY well originate from a different IP address than my SSH session, and I would never be able to connect.
3. Many devices are mobile, and they can change their IP address when they pass from WiFi to LTE for example. This would force an unnecessary re-auth.
- sullivanmatt 7y agoI want to be clear about the use case that the enterprise port knocking solution is trying to solve: it's an additional control that would not normally even be in place. In most setups, you are exposing some sort of relay to the internet, through which your users can access the services after authentication - such as an SSH bastion host or a VPN. The IP based whitelisting mechanism is simply a layer to allow you to not have to compromise and expose anything to the world wide internet. The actual authentication and authorization mechanism is the certificate-based set of SSH connections.
- BlueTemplar 7y agoNAT and single IP adresses for multiple users are going away with IPv6 ?
- zamadatix 7y agoEventually, for now v4 CGNAT exists too though.