Beginner Address Authentication Question

[young138]

I'm new to Shibboleth and trying a very basic ECP setup for a lab. I had it
working at one point but had to revert to an earlier image on the machine
and I can't seem to get it to working again. I have the idp.authn.flows set
to IPAddress|Password and I can see in the logs that the flow is being used
but the agent is not being authenticated:

2016-01-08 10:31:38,316 - DEBUG
[org.springframework.webflow.engine.SubflowState:99] - Calling subflow
'authn/IPAddress' with input map['calledAsSubflow' -> true]
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.binding.mapping.impl.DefaultMapper:60] - Beginning
mapping between source
[org.springframework.webflow.core.collection.LocalAttributeMap] and target
[org.springframework.webflow.engine.impl.RequestControlContextImpl]
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.binding.mapping.impl.DefaultMapping:147] - Adding
mapping result [Success at 2875939 mapping = calledAsSubflow ->
flowScope.calledAsSubflow, code = 'success', error = false, originalValue =
true, mappedValue = true]
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.binding.mapping.impl.DefaultMapper:69] - Completing
mapping between source
[org.springframework.webflow.core.collection.LocalAttributeMap] and target
[org.springframework.webflow.engine.impl.RequestControlContextImpl]; total
mappings = 1; total errors = 0
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.webflow.engine.ActionState:189] - Entering state
'UserAgentAddress' of flow 'authn/IPAddress'
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.webflow.execution.ActionExecutor:49] - Executing
[EvaluateAction at ffb6441 expression = ExtractUserAgentAddress,
resultExpression = [null]]
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.webflow.execution.AnnotatedAction:142] - Putting action
execution attributes map[[empty]]
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.beans.factory.support.DefaultListableBeanFactory:450] -
Creating instance of bean 'ExtractUserAgentAddress'
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.beans.factory.support.DefaultListableBeanFactory:248] -
Returning cached instance of singleton bean 'shibboleth.HttpServletRequest'
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.beans.factory.support.DefaultListableBeanFactory:248] -
Returning cached instance of singleton bean
'shibboleth.authn.IPAddress.Transforms'
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.beans.factory.support.DefaultListableBeanFactory:1666]
- Invoking init method  'initialize' on bean with name
'ExtractUserAgentAddress'
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.beans.factory.support.DefaultListableBeanFactory:478] -
Finished creating instance of bean 'ExtractUserAgentAddress'
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.webflow.execution.ActionExecutor:49] - Executing
net.shibboleth.idp.authn.impl.ExtractUserAgentAddress at 1745e993
2016-01-08 10:31:38,316 - DEBUG
[net.shibboleth.idp.authn.AbstractExtractionAction:137] - Profile Action
ExtractUserAgentAddress: Trimming whitespace of input string
'2620:102:c000:f10:d:0:0:29c1'
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.webflow.execution.ActionExecutor:53] - Finished
executing net.shibboleth.idp.authn.impl.ExtractUserAgentAddress at 1745e993;
result = null
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.webflow.execution.AnnotatedAction:149] - Clearing
action execution attributes map[[empty]]
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.webflow.execution.ActionExecutor:53] - Finished
executing [EvaluateAction at ffb6441 expression = ExtractUserAgentAddress,
resultExpression = [null]]; result = null
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.webflow.engine.ActionState:120] - Action execution [1]
returned a [null] event: proceeding to the next action in the list
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.webflow.execution.ActionExecutor:49] - Executing
[EvaluateAction at 608e6e5a expression = ValidateUserAgentAddress,
resultExpression = [null]]
2016-01-08 10:31:38,316 - DEBUG
[org.springframework.webflow.execution.AnnotatedAction:142] - Putting action
execution attributes map[[empty]]
2016-01-08 10:31:38,332 - DEBUG
[org.springframework.beans.factory.support.DefaultListableBeanFactory:450] -
Creating instance of bean 'ValidateUserAgentAddress'
2016-01-08 10:31:38,332 - DEBUG
[org.springframework.beans.factory.support.DefaultListableBeanFactory:248] -
Returning cached instance of singleton bean
'shibboleth.authn.IPAddress.Mappings'
2016-01-08 10:31:38,332 - DEBUG
[org.springframework.beans.factory.support.DefaultListableBeanFactory:1666]
- Invoking init method  'initialize' on bean with name
'ValidateUserAgentAddress'
2016-01-08 10:31:38,332 - DEBUG
[org.springframework.beans.factory.support.DefaultListableBeanFactory:478] -
Finished creating instance of bean 'ValidateUserAgentAddress'
2016-01-08 10:31:38,332 - DEBUG
[org.springframework.webflow.execution.ActionExecutor:49] - Executing
net.shibboleth.idp.authn.impl.ValidateUserAgentAddress at 644b2070
2016-01-08 10:31:38,332 - DEBUG
[net.shibboleth.idp.authn.impl.ValidateUserAgentAddress:146] - Profile
Action ValidateUserAgentAddress: User agent with address
2620:102:c000:f10:d:0:0:29c1 was not authenticated
2016-01-08 10:31:38,332 - DEBUG
[org.springframework.webflow.execution.ActionExecutor:53] - Finished
executing net.shibboleth.idp.authn.impl.ValidateUserAgentAddress at 644b2070;
result = InvalidCredentials
2016-01-08 10:31:38,332 - DEBUG
[org.springframework.webflow.execution.AnnotatedAction:149] - Clearing
action execution attributes map[[empty]]
2016-01-08 10:31:38,332 - DEBUG
[org.springframework.webflow.execution.ActionExecutor:53] - Finished
executing [EvaluateAction at 608e6e5a expression = ValidateUserAgentAddress,
resultExpression = [null]]; result = InvalidCredentials

I don't have much control over the ECP client I'm using but I know it
doesn't work with password based authentication (It should work with
IPAddress|Password since I've had it working with that before). I have the
ipaddress-authn-config.xml with:
    <util:map id="shibboleth.authn.IPAddress.Mappings">
        
        <entry key="USER">
            <list>
                <value>10.0.0.0/8</value>
		<value>2620:102:c000::1/48</value>
            </list>
        </entry>
        
    </util:map>
and I am trying to log in with USER from 2620:102:c000:f10:d:0:0:29c1.

Does "[EvaluateAction at ffb6441 expression = ExtractUserAgentAddress,
resultExpression = [null]]" mean it stripped out the entire ipv6 and thinks
the address is empty? Any guidance or material to reference would be
appreciated. 



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Beginner-Address-Authentication-Question-tp7621699.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.