Beginner Address Authentication Question

[Tom Zeller]

> On Jan 8, 2016, at 9:45 AM, young138 <young138 at purdue.edu> wrote:
> 
> I'm new to Shibboleth and trying a very basic ECP setup for a lab. I had it
> working at one point but had to revert to an earlier image on the machine
> and I can't seem to get it to working again. I have the idp.authn.flows set
> to IPAddress|Password and I can see in the logs that the flow is being used
> but the agent is not being authenticated:
> 
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.webflow.engine.SubflowState:99] - Calling subflow
> 'authn/IPAddress' with input map['calledAsSubflow' -> true]
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.binding.mapping.impl.DefaultMapper:60] - Beginning
> mapping between source
> [org.springframework.webflow.core.collection.LocalAttributeMap] and target
> [org.springframework.webflow.engine.impl.RequestControlContextImpl]
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.binding.mapping.impl.DefaultMapping:147] - Adding
> mapping result [Success at 2875939 mapping = calledAsSubflow ->
> flowScope.calledAsSubflow, code = 'success', error = false, originalValue =
> true, mappedValue = true]
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.binding.mapping.impl.DefaultMapper:69] - Completing
> mapping between source
> [org.springframework.webflow.core.collection.LocalAttributeMap] and target
> [org.springframework.webflow.engine.impl.RequestControlContextImpl]; total
> mappings = 1; total errors = 0
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.webflow.engine.ActionState:189] - Entering state
> 'UserAgentAddress' of flow 'authn/IPAddress'
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.webflow.execution.ActionExecutor:49] - Executing
> [EvaluateAction at ffb6441 expression = ExtractUserAgentAddress,
> resultExpression = [null]]
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.webflow.execution.AnnotatedAction:142] - Putting action
> execution attributes map[[empty]]
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.beans.factory.support.DefaultListableBeanFactory:450] -
> Creating instance of bean 'ExtractUserAgentAddress'
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.beans.factory.support.DefaultListableBeanFactory:248] -
> Returning cached instance of singleton bean 'shibboleth.HttpServletRequest'
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.beans.factory.support.DefaultListableBeanFactory:248] -
> Returning cached instance of singleton bean
> 'shibboleth.authn.IPAddress.Transforms'
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.beans.factory.support.DefaultListableBeanFactory:1666]
> - Invoking init method  'initialize' on bean with name
> 'ExtractUserAgentAddress'
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.beans.factory.support.DefaultListableBeanFactory:478] -
> Finished creating instance of bean 'ExtractUserAgentAddress'
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.webflow.execution.ActionExecutor:49] - Executing
> net.shibboleth.idp.authn.impl.ExtractUserAgentAddress at 1745e993
> 2016-01-08 10:31:38,316 - DEBUG
> [net.shibboleth.idp.authn.AbstractExtractionAction:137] - Profile Action
> ExtractUserAgentAddress: Trimming whitespace of input string
> '2620:102:c000:f10:d:0:0:29c1'
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.webflow.execution.ActionExecutor:53] - Finished
> executing net.shibboleth.idp.authn.impl.ExtractUserAgentAddress at 1745e993;
> result = null
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing
> action execution attributes map[[empty]]
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.webflow.execution.ActionExecutor:53] - Finished
> executing [EvaluateAction at ffb6441 expression = ExtractUserAgentAddress,
> resultExpression = [null]]; result = null
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.webflow.engine.ActionState:120] - Action execution [1]
> returned a [null] event: proceeding to the next action in the list
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.webflow.execution.ActionExecutor:49] - Executing
> [EvaluateAction at 608e6e5a expression = ValidateUserAgentAddress,
> resultExpression = [null]]
> 2016-01-08 10:31:38,316 - DEBUG
> [org.springframework.webflow.execution.AnnotatedAction:142] - Putting action
> execution attributes map[[empty]]
> 2016-01-08 10:31:38,332 - DEBUG
> [org.springframework.beans.factory.support.DefaultListableBeanFactory:450] -
> Creating instance of bean 'ValidateUserAgentAddress'
> 2016-01-08 10:31:38,332 - DEBUG
> [org.springframework.beans.factory.support.DefaultListableBeanFactory:248] -
> Returning cached instance of singleton bean
> 'shibboleth.authn.IPAddress.Mappings'
> 2016-01-08 10:31:38,332 - DEBUG
> [org.springframework.beans.factory.support.DefaultListableBeanFactory:1666]
> - Invoking init method  'initialize' on bean with name
> 'ValidateUserAgentAddress'
> 2016-01-08 10:31:38,332 - DEBUG
> [org.springframework.beans.factory.support.DefaultListableBeanFactory:478] -
> Finished creating instance of bean 'ValidateUserAgentAddress'
> 2016-01-08 10:31:38,332 - DEBUG
> [org.springframework.webflow.execution.ActionExecutor:49] - Executing
> net.shibboleth.idp.authn.impl.ValidateUserAgentAddress at 644b2070
> 2016-01-08 10:31:38,332 - DEBUG
> [net.shibboleth.idp.authn.impl.ValidateUserAgentAddress:146] - Profile
> Action ValidateUserAgentAddress: User agent with address
> 2620:102:c000:f10:d:0:0:29c1 was not authenticated
> 2016-01-08 10:31:38,332 - DEBUG
> [org.springframework.webflow.execution.ActionExecutor:53] - Finished
> executing net.shibboleth.idp.authn.impl.ValidateUserAgentAddress at 644b2070;
> result = InvalidCredentials
> 2016-01-08 10:31:38,332 - DEBUG
> [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing
> action execution attributes map[[empty]]
> 2016-01-08 10:31:38,332 - DEBUG
> [org.springframework.webflow.execution.ActionExecutor:53] - Finished
> executing [EvaluateAction at 608e6e5a expression = ValidateUserAgentAddress,
> resultExpression = [null]]; result = InvalidCredentials
> 
> I don't have much control over the ECP client I'm using but I know it
> doesn't work with password based authentication (It should work with
> IPAddress|Password since I've had it working with that before). I have the
> ipaddress-authn-config.xml with:
>    <util:map id="shibboleth.authn.IPAddress.Mappings">
> 
>        <entry key="USER">
>            <list>
>                <value>10.0.0.0/8</value>
> 		<value>2620:102:c000::1/48</value>
>            </list>
>        </entry>
> 
>    </util:map>
> and I am trying to log in with USER from 2620:102:c000:f10:d:0:0:29c1.
> 
> Does "[EvaluateAction at ffb6441 expression = ExtractUserAgentAddress,
> resultExpression = [null]]" mean it stripped out the entire ipv6 and thinks
> the address is empty? Any guidance or material to reference would be
> appreciated. 

No, you can ignore that Spring Web Flow log message. And, the address is logged :

> 2016-01-08 10:31:38,332 - DEBUG
> [net.shibboleth.idp.authn.impl.ValidateUserAgentAddress:146] - Profile
> Action ValidateUserAgentAddress: User agent with address
> 2620:102:c000:f10:d:0:0:29c1 was not authenticated