CMiC API and OAuth 2.0 Integration - OAuth 2.0 - Frequently Asked Questions

Is the ipaddr claim value being compared against the IP address making the API request or to a list of allowed IP addresses?

Yes, the IP address is being checked against the client IP based on the X-FORWARED-FOR header.

Why does IP Check fail?

The IP Check can fail due to multiple reasons:

1. The access token has the real client IP, but the request was made on a VPN and the server gets the VPN IP.

   1. Check with your IT team.

2. No ipaddr claim due to Identity Provider (IdP) setup not passing it.

   1. Check with your IT Team.

3. No ipaddr claim due to the use of client credentials and the IdP does not pass it.

   1. This is a missing fix that’s part of Patch 20 to support client credentials.