@Override
    public AuthenticationHandlerExecutionResult authenticate(final Credential credential, final Service service) throws Throwable {
        val addressCredential = (RemoteAuthenticationCredential) credential;
        if (this.inetNetmask != null && this.inetNetworkRange != null) {
            try {
                val inetAddress = InetAddress.getByName(addressCredential.getRemoteAddress().trim());
                if (containsAddress(this.inetNetworkRange, this.inetNetmask, inetAddress)) {
                    return new DefaultAuthenticationHandlerExecutionResult(this, addressCredential,
                        principalFactory.createPrincipal(addressCredential.getId()));
                }
            } catch (final UnknownHostException e) {
                LOGGER.debug("Unknown host [{}]", addressCredential.getRemoteAddress());
            }
        }
        throw new FailedLoginException(addressCredential.getRemoteAddress() + " not in allowed range.");
    }
Checks if a subnet contains a specific IP address.

@param network The network address.
@param netmask The subnet mask.
@param ip      The IP address to check.
@return A boolean value.
support/cas-server-support-generic-remote-webflow/src/main/java/org/apereo/cas/adaptors/generic/remote/RemoteAddressAuthenticationHandler.java