From 34d8bf10a29361d9071638264c1e0d97bab10366 Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Tue, 28 Apr 2026 09:51:32 +0200 Subject: [PATCH] Use forwarded headers for SCIM event client IP The SCIM event handler read the client address from r.RemoteAddr only, so when probod runs behind an HTTP load balancer every event row recorded the load balancer's internal IP. Switch to clientip.Extract, which honors the Forwarded / X-Forwarded-For headers already validated by trustedproxy middleware. Signed-off-by: Bryan Frimin --- pkg/server/api/connect/v1/scim_handler.go | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/pkg/server/api/connect/v1/scim_handler.go b/pkg/server/api/connect/v1/scim_handler.go index e7785a574..e20d2bc06 100644 --- a/pkg/server/api/connect/v1/scim_handler.go +++ b/pkg/server/api/connect/v1/scim_handler.go @@ -32,6 +32,7 @@ import ( "go.probo.inc/probo/pkg/gid" "go.probo.inc/probo/pkg/iam" scimservice "go.probo.inc/probo/pkg/iam/scim" + "go.probo.inc/probo/pkg/server/api/clientip" ) type ( @@ -337,12 +338,7 @@ func (h *scimResourceHandler) Delete(r *http.Request, id string) error { } func getIPAddress(r *http.Request) net.IP { - host, _, err := net.SplitHostPort(r.RemoteAddr) - if err != nil { - host = r.RemoteAddr - } - - if ip := net.ParseIP(host); ip != nil { + if ip := net.ParseIP(clientip.Extract(r)); ip != nil { return ip }