SPIKE: Supporting Multi Tenants (based on IP) is problematic for MeeScan

I think the simplest solution, which is likely to be the easiest for hosts and users of Meescan, is to support an additional optional configuration property for port. This can be combined with our existing support of IP addresses (the CIDR range). This will be as secure as our current implementation and allow us to support Meescan with minimal effort.

Instead of identifying the tenant only by the IP address, we can check the configuration for the inbound IP address. If the config entry has a port, we can see if the request is occurring at that port, and use the port/ip combination to identify the tenant when the port is in scope in the config.

I did talk to Meescan, and they do support TLS and certificates. We would give them a cert for each tenant which they would then use to secure the connection coming from a given machine.

They can support 3 methods of identifying the tenant from the request: 1) certs (as you mention), 2) assigning a port to a tenant, and 3) using a combination of the Location and Institution field. I think 1 and 2 would be easiest to implement, and 1 would be the most secure. 2 would probably a bit easier to maintain and implement. Could also be made backwards compatible. 

edge-sip2 supports TLS encryption: https://github.com/folio-org/edge-sip2#security

TLS client and/or server certificates are designed to prove the identity and can be used to determine the tenant id.

MeeScan says: "Our kiosks are compatible with all types of security and various authentication methods." Does this also apply to TLS client certificates?

After some discussion we have determined that identifying tenants with something other than IP won't work well with our archtiecture. We'd like to see what MeeScan can do for us. Talking with them next week.

I think what we need to do with this spike:
1. What is the background on our current architecture for using the IP address to identify tenants. Why was this chosen instead of something else?
2. Are there any viable alternatives for using IP addresses? What would a solution that didn't use IP addresses to identify tenants look like?