Resolve Remote IP Mismatch Errors when Authenticating to GCKey

Introduction

This document describes how to resolve remote IP mismatch errors when you authenticate to the GCKey service.

Overview

You may experience errors authenticating to the GCKey service due to a remote IP address mismatch. This issue can occur after submitting credentials if the captcha service provider detects a different IP address than the GCKey service for the same user. The result is an "Invalid Session" error.

What Is Remote IP Mismatch?

GCKey integrates with a captcha service provider to improve security. One mechanism used is IP address verification, which helps prevent abuse from captcha farms and similar sources. A remote IP mismatch occurs when the captcha provider and GCKey service see different IP addresses for the same user.

• When a remote IP mismatch occurs, users cannot complete authentication and see an "Invalid Session" error.
• This error can also appear due to other issues, such as browser cache problems. First, try standard troubleshooting:
  • Clear the browser cache.
  • Use a private or incognito window.
  • Switch browsers.
• If typical troubleshooting does not resolve the issue, a remote IP mismatch may be the cause.

How Remote IP Matching Works

GCKey’s captcha integration uses a two-step process:

1. The user's browser communicates directly with the captcha provider using JavaScript. The captcha provider records the user's IP address and returns a token.
2. The user submits their credentials to GCKey along with the token from the captcha provider. GCKey sends the token and the IP address it sees to the captcha provider for verification.

If the IP addresses from steps 1 and 2 do not match, the captcha provider fails the verification, and the user sees the "Invalid Session" error.

Resolve Remote IP Mismatch When Using Umbrella SWG

To resolve remote IP mismatch errors for GCKey authentication when using Umbrella Secure Web Gateway (SWG):

• Add these domains to your external domains management list:
  • clegc-gckey.gc.ca
  • hcaptcha.com

What Is a Remote IP Mismatch?

GCKey uses a captcha service provider to improve security and prevent abuse. As part of this integration, the provider verifies the user’s IP address to stop captcha farms and other malicious activity. A remote IP mismatch occurs when the captcha provider and GCKey see different IP addresses.

• When this occurs, authentication fails and you see an "Invalid Session" error.
• The "Invalid Session" error can also appear for other reasons.
  • First, try standard troubleshooting steps:
    • Clear the browser cache.
    • Use a private or incognito window.
    • Switch browsers.
• If these steps do not resolve the issue, a remote IP mismatch is likely the cause.

How Remote IP Matching Works

GCKey’s captcha integration is a two-step process:

1. The user's browser communicates directly with the captcha provider using JavaScript. The captcha provider records the user’s IP address and returns a token.
2. The user submits credentials to GCKey, which includes the token from the captcha provider. GCKey passes the token and the IP address it sees to the captcha provider for verification.

If the IP addresses from steps 1 and 2 do not match, the captcha provider fails the verification and you see the "Invalid Session" error.

Resolve Remote IP Mismatch When Using Umbrella SWG

To resolve remote IP mismatch errors for GCKey authentication with Umbrella Secure Web Gateway (SWG):

• Add these domains to your external domains management list:
  • clegc-gckey.gc.ca
  • hcaptcha.com