[Koha] OPAC session invalidation due to changing IP

[Lebbeous Fogle-Weekley]

Hi all,

My question concerns a Koha 3.6.4 site.  A significant number of patrons 
seem to be reporting that they frequently get their login sessions 
invalidated with the following message: "You are logging from a 
different IP address. Please log in again."  This happens often enough 
to prevent them from placing all the holds or renewals that they would like.

Now I could imagine that in fact, their IP addresses are rapidly 
changing due to a misbehaving ISP.  In this case, I would expect there 
to be little remedy for the situation as the code stands today . I 
looked at C4::Auth::check_api_auth() and C4::Auth::check_cookie_auth(), 
and I do understand why under normal circumstances, it is a good idea to 
invalidate sessions once they're accessed by a second IP address.

But are there other possible explanations for why users would encounter 
this message, or can anybody recommend troubleshooting steps that would 
either confirm or deny that the affected patrons' IP addresses do change?

Network layer troubleshooting is as welcome a suggestion as any, but if 
there is something in, say, the Koha logs that could also help, I would 
appreciate any pointers.

Thanks,
-- 
Lebbeous Fogle-Weekley
  | Software Developer
  | Equinox Software, Inc. / Your Library's Guide to Open Source
  | phone:  1-877-OPEN-ILS (673-6457)
  | email:  lebbeous at esilibrary.com
  | web:  http://www.esilibrary.com