Ensuring Accurate End-User IP Propagation for Risk Analysis in OIDC and SAML Authentication Flows

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

AuthHub (IDSP) performs adaptive risk analysis on every authentication event to detect anomalous behavior, account takeover attempts, and policy violations. This analysis is only as accurate as the end-user IP address it receives. When UIs are deployed behind an F5 BIG-IP load balancer, the originating client IP travels in the X-Forwarded-For HTTP header — but IDSP's risk engine reads the ipAddress field in the POST /auth/v1/authenticate JSON body, not the inbound network source IP.

This article identifies the exact API calls in each supported authentication flow that trigger risk analysis, and provides the required implementation steps for UI teams to correctly populate ipAddress so that IDSP audit records reflect the true end-user IP rather than an internal proxy or Access Gateway address.

Environment

Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Resolution

Apply the following steps to both flows. Flow-specific steps are called out where the implementation differs.

• Read X-Forwarded-For from the inbound F5 request

On every request that initiates or continues an authentication session, read the X-Forwarded-For header set by the F5 BIG-IP. The first IP in a comma-separated list is the originating client IP.

• [SAML only] Store client IP in session state before the redirect

Before issuing the redirect to SiteMinder/Access Gateway, persist the captured IP in server-side session storage keyed to the user's session. This value must survive the round-trip through the IdP.

• Populate "ipAddress" in every POST /auth/v1/authenticate body

Set the ipAddress field in the JSON request body on the begin-flow call and all subsequent POST /auth/v1/authenticate calls within the same session. For SAML flows, retrieve the value from session state rather than from the current request headers, which will reflect the Access Gateway's IP after the redirect.

• Do not rely on X-Forwarded-For reaching IDSP backend services

The X-Forwarded-For HTTP header may not be preserved through all internal hops between your UI and IDSP's backend. The ipAddress JSON body field is the authoritative input for risk analysis and must be explicitly populated by the UI layer on every authenticate call.