We want to restrict access for only users on our VPN only [some conceptual overlap with this post except our question is just about network-ip restriction]
Our data is in Snowflake, where we can implement network policies to limit access to only our VPN. Very handy!
Retool doesn’t have network policy per se, and we’d like to bolt something on, to simulate that feature, if possible.
SSO is already configured so that users authenticate using Shibboleth as IdP, and we are thinking of tweaking it to only authenticate for VPN addresses. (Relaying-party-scoped to match the branded retool domains in use.) Hypothetically this could/would behave similar to snowflake’s network policy.
Do you know anybody who has tried something like that with an IdP? Any gotchas?
What are the potential drawbacks?
Feedback welcome, thanks!
We are on retool enterprise, retool cloud. (Trying to avoid the complexity of multiple instances of self-hosted.)
Hey @trillich - the approach your proposing sounds like the most common pattern and best bet. I'm not sure about Shibboleth, in particular, but most IdPs will let you define trusted network ranges and your VPN likely has a static set of egress IPs. Alternatively, there may be an option to to verify the incoming request via trust certificate.
As far as drawbacks are concerned, I think it's mostly just important to understand that this approach gates a single step - authentication - and not general access. Once the token is granted, there won't be any additional network checks unless Shibboleth supports Continuous Access Evaluation like Entra. And just to be clear, any public surfaces would remain public.
That’s kinda what we’ve been thinking. Authenticating based on IP address is a start!
Are there other crazies out there wanting to IP-gate access to Retool apps, ala “network policy” or is it just us? If it was a possible add-on feature within Retool itself in the future, that’d be marvelous
If it was a possible add-on feature within Retool itself in the future, that’d be marvelous 