I have Apache/Shibboleth serving requests to a reverse proxy and directly to web clients. When a request comes through the proxy I extract the original IP address and attempt to send it to shibboleth. However, this does not appear to be working correctly. It still gives me an error that the IP address doesn't match the one used when authenticated with the IdP.
I have the following Location block in my apache config. I know that REMOTE_ADDR is at least getting sent to shibd since when I set it to X-Forwarded-For the error includes the entire chain of proxy IPs but the following doesn't work and just shows the last proxy's IP address as not matching the authed IP.
<Location />
SetEnvIf X-FORWARDED-FOR "^.+$" DenyRequest
SetEnvIf Remote_Addr "^XXX\.XXX\.XXX\.XXX$" !DenyRequest
Order allow,deny
Deny from env=DenyRequest
Allow from all
SetEnvIf Remote_Addr "^(.+)$" RealAddress=$1
SetEnvIf X-Forwarded-For "^(\d{1,3}+\.\d{1,3}+\.\d{1,3}+\.\d{1,3}+).*" RealAddress=$1
RequestHeader set X-RealAddress %{RealAddress}e
AuthType shibboleth
ShibRequestSetting requireSession 1
ShibRequestSetting REMOTE_ADDR X-RealAddress
Require user
</Location>