# SPI for consistent inbound IP for sessions

**URL:** <https://forum.keycloak.org/t/spi-for-consistent-inbound-ip-for-sessions/29767>\
**Category:** Extending the server\
**Tags:** authentication\
**Created:** [March 18, 2025, 9:24pm UTC](https://forum.keycloak.org/t/spi-for-consistent-inbound-ip-for-sessions/29767 "2025-03-18T21:24:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dewmera](https://avatars.discourse-cdn.com/v4/letter/d/9e8a1a/32.png) [@dewmera](https://forum.keycloak.org/u/dewmera)\
**Post date:** [March 18, 2025, 9:24pm UTC](https://forum.keycloak.org/t/spi-for-consistent-inbound-ip-for-sessions/29767/1 "2025-03-18T21:24:56Z")

</div>

Hello,

I’m currently trying to satisfy the following [STIG](https://stigviewer.com/stig/web_server_security_requirements_guide/2024-09-09/finding/V-264361) - which would restrict users to using a consistent inbound source IP for the entire user session. If the user session IP has changed, the preferred action would be to trigger a logout. While research suggests that Keycloak is not a “traditional” web server, I would like to try and implement this rule. I’ve attempted to create a custom Authentication SPI for this “IP Restriction” rule, but to no luck.

First, does anyone know if this is handled by Keycloak? I could not find any details in the documentation.

Secondly, is what I’m trying to accomplish possible with a Keycloak SPI?

Any help or information on this topic would be greatly appreciated. Thanks.

---

<div class="post-metadata">

**Author:** ![bpedersen2](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/bpedersen2/32/3934_2.png) [@bpedersen2](https://forum.keycloak.org/u/bpedersen2)\
**Post date:** [March 19, 2025, 7:39am UTC](https://forum.keycloak.org/t/spi-for-consistent-inbound-ip-for-sessions/29767/2 "2025-03-19T07:39:21Z")

</div>

You probably could do that by overriding the Cookie authenticator ( that is what handles the keycloak sessions).  
But I don’t see how this would really improve anything ( better use a short enough session lifetime + 2FA ) and it would only affect SSO behaviour. Depending on how your downstream services handle auth, logins there would only be affected if they see a need to re-authenticate with keycloak, typically only after their session lifetime expired.  
You would also need to implement it in all downstream services that use Keycloak to authenticate.