AccessByIPAddress with IPv6 addresses

[Paul B. Henson]

I created a custom AccessControlPolicies entry to give our load balancer
access to the status page:

<entry key="StatusAccessByIPAddress">
  <bean id="AccessByIPAddress" parent="shibboleth.IPRangeAccessControl"
       p:allowedRanges="#{ {'127.0.0.1/32', '::1/128',
                            '134.71.246.194/32', '134.71.246.195/32',
                            '2620:df:8000:ff14:0:0:0:2/128', '2620:df:8000:ff14:0:0:0:3/128'} }" />
</entry>

This works fine for the IPv4 addresses in the list, but the IPv6 access
still fails:

2020-10-18 12:21:17,258 - [2620:df:8000:ff14:0:0:0:2]/node01tp5yfd6x2b2a17mrvn5vvi1qy167 - WARN [net.shibboleth.utilities.java.support.security.impl.IPRangeAccessControl:95] - Policy AccessByIPAddress: Denied request from client address '[2620:df:8000:ff14:0:0:0:2]' (Operation: read, Resource: status)

In addition, it gives another goofy error:

2020-10-18 12:21:27,109 - [2620:df:8000:ff14:0:0:0:3]/node01scm3bd299jry1l5am135loc40170 - WARN [net.shibboleth.utilities.java.support.security.impl.IPRangeAccessControl:92] - Policy AccessByIPAddress: Error translating client address
java.lang.IllegalArgumentException: '[2620:df:8000:ff14:0:0:0:3]' is not an IP string literal.
        at com.google.common.net.InetAddresses.formatIllegalArgumentException(InetAddresses.java:1080)

Do I have something misconfigured? I feel like java is returning the IPv6
address in brackets but the access control code doesn't expect them 8-/.


-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768