Restricting access by IP when users are mobile

@tonyzeoli is your client targeting their drivers with some sort of webapp on their iPads? If so, it may be easier to restrict access to those who are logged into WordPress. If not, could you help provide some more details about the specific use case so we can see how Restricted Site Access could help? Thanks!

Hi Jeffrey,

Thanks for your note.

The client owns a “black car” service and arms every driver with an iPad in the vehicle. The client is setting up a Knowledge Base for the drivers so that they can use WordPress to access information from the WordPress site. I guess you would think of this as an “extranet.”

If the driver is, for example, headed to the airport and wants to learn the best pickup procedure for that airpot, they pick up their iPad, navigate to a URL, and then need to be able to login to the front end and maybe complete a search of teh database.

The client has 300 drivers. No one other than the drivers should be able to access this site. So, they all are registered users of the site, but he doesn’t want the site URL to be available to anyone without a company issued iPad.

So, if I don’t have an iPad and I try to get to the URL through any other method, it shows me that I do not have access to this site. Only users with the iPad’s have access. Even if they used their own mobile phones, they wouldn’t have access. They would only have access from the issued iPad. I would assume that each iPad has a unique address, but I”m not sure.

I guess you would restrict by MAC address? Is that right? So can you add all users with their iPad MAC addresses and restrict that way?

Justin,

Google is sending out these notifications to all my clients for whom I’m using your wonderful Breadcrumbs plugin. I know in these support threads you say it’s not an issue (reported over a year ago), but it becomes one when you talk to a client and they don’t understand why they are getting this notice. You can’t just tell them to ignore it. While you say it isn’t a problem in prior threads, it is to the client and they won’t want to receive these warnings. Can you please fix this issue, so that developers and agencies won’t have to be burdened with clients who want this issue resolved.

See screenshots: https://cloudup.com/cxOJWAVSfh7

@tonyzeoli it looks like your last message may have been meant for a different plugin forum, so you may want to ensure you get that posted elsewhere accordingly.

As for the MAC address bit, I believe that only gets passed along to the router/switch that a device is connected to so its something an ISP or your local cable modem could utilize but I don’t believe that gets provided all the way back such that WordPress or Restricted Site Access could utilize it. In reviewing the IPv6 standard, it looks like there may be a way to identify folks accessing via a specific mobile device (in your case, iPads) assuming you’re using IPv6 address auto-configuration as you may be able to target the Interface Identifier (MAC address) for the device’s stable address. See more details on that here: https://en.wikipedia.org/wiki/IPv6#SLAAC_privacy_extensions.

I’d like to chat through this with the team to see what other options may be available before we determine what’s the best course on this. I’ve opened an issue in our GitHub repository where we’ll track discussions on this with our team and work towards any potential resolution, feel free to track that here: https://github.com/10up/restricted-site-access/issues/105.

Thanks!

Yes, sorry about that. I had two windows open. I’ll see if I can edit that and remove it and put it where it’s supposed to go.

Thanks for getting back to me on this. Any more info you can glean about the best way to do this would be great!

Guess I can’t edit that incorrect post after a certain period of time. Sorry about that.

Looks like we are going to use SMS using the Orion plugin for WordPress to restrict access. Drivers will be added to a third party service, submit their phone number, and get back a code to login. So, we’re not going to need this method anymore, however, it would be useful so we didn’t have to go that route.

@tonyzeoli best of luck on that route, we’ll continue to track any enhancement to Restricted Site Access via the discussion here: https://github.com/10up/restricted-site-access/issues/105.