<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
For anyone looking in future:
<div class=""><br class="">
</div>
<div class="">This was tracked down to a Jetty bug - <font color="#0052cc" face="-apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Oxygen, Ubuntu, Fira Sans, Droid Sans, Helvetica Neue, sans-serif" class=""><span style="cursor: pointer; font-size: 14px;" class=""><a href="https://github.com/eclipse/jetty.project/issues/1503" class="">https://github.com/eclipse/jetty.project/issues/1503</a></span></font></div>
<div class=""><br class="">
</div>
<div class="">We have a patched version - but the setting is disabled by default in the 9.x branch (will be true by default on 10.x)</div>
<div class=""><br class="">
</div>
<div class="">Took me an inordinate amount of time trying to work out how to actually set the systems property “org.eclipse.jetty.util.HostPort.STRIP_IPV6" to true. We are using modules to configure jetty - so I have done it in a .mod file by adding the following
lines:</div>
<div class="">[ini]</div>
<div class="">-Dorg.eclipse.jetty.util.HostPort.STRIP_IPV6=true<br class="">
<div class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On 29 Jul 2019, at 9:20 am, Aaron Howell <<a href="mailto:aaron.howell@deakin.edu.au" class="">aaron.howell@deakin.edu.au</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Cheers - I have logged a bug for this issue: <a href="https://issues.shibboleth.net/jira/browse/IDP-1477" class="">IDP-1477</a>
<div class=""><br class="">
</div>
<div class="">I would say there isn’t much to know about IPv6 at a programming level - it is mostly just the formatting rules for addresses are different. Realistically an application shouldn’t need to do too much to support the protocol - it's just a different
courier company.</div>
<div class=""><br class="">
</div>
<div class="">I presume that most SPs are following the recommendation of section 5.1 in <a href="https://tools.ietf.org/html/rfc4038" class="">https://tools.ietf.org/html/rfc4038</a>. Which pretty much boils down to, be liberal in the format that is accepted.</div>
<div class=""><br class="">
</div>
<div class="">As for the other input - firstly I don’t think this is the default format - my guess on this is that it is Jetty can return different formats of IPv6 addresses depending on circumstances, and the IdP is simply passing it through unaltered. So
different configurations, and different servlet engines may have different results. Secondly it would be extremely surprising to find that something only accepted the square bracket format - as because of the first point they would only likely work with a
subset of IdP implementations. Thirdly, even if the rest weren’t true, any that did only support square brackets - it would be against spec anyway - so they should really fix the issue.</div>
<div class=""><br class="">
</div>
<div class="">Cheers,</div>
<div class="">Aaron<br class="">
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">On 27 Jul 2019, at 3:22 am, Yeargan, Yancey <<a href="mailto:Yancey.Yeargan@untsystem.edu" class="">Yancey.Yeargan@untsystem.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
If the default format for IPv6 addresses should change in new versions of the IdP, legacy installs would need to continue using the old format indefinitely. In that scenario, some way to choose (override) the format on a per relying party level within the IdP
would be appropriate. New versions of the SP could accept an IPv6 address with or without the brackets. Perhaps the SP does that already.
<div class="">
<div class=""><br class="">
<div class="">
<div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Calibri; font-size: 13px; orphans: 2; widows: 2;" class="">
<b style="font-size: 14px;" class="">Yancey Yeargan</b></div>
<div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Calibri; font-size: 13px; orphans: 2; widows: 2; margin: 0in 0in 0.0001pt;" class="">
<span style="font-size: 14px;" class="">IT Manager<o:p class=""></o:p></span></div>
<div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Calibri; font-size: 13px; orphans: 2; widows: 2; margin: 0in 0in 0.0001pt;" class="">
<span style="font-size: 14px;" class="">IT Shared Services</span></div>
<div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Calibri; font-size: 13px; orphans: 2; widows: 2; margin: 0in 0in 0.0001pt;" class="">
<span style="font-size: 14px;" class="">____________<span style="text-align: -webkit-auto;" class="">_</span><span style="text-align: -webkit-auto;" class="">_</span><span style="text-align: -webkit-auto;" class="">_</span><span style="text-align: -webkit-auto;" class="">_</span><span style="text-align: -webkit-auto;" class="">_</span><span style="text-align: -webkit-auto;" class="">_</span><span style="text-align: -webkit-auto;" class="">_</span><span style="text-align: -webkit-auto;" class="">____</span>_<span style="text-align: -webkit-auto;" class="">_</span><span style="text-align: -webkit-auto;" class="">_______</span></span></div>
<div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Calibri; font-size: 13px; orphans: 2; widows: 2; margin: 0in 0in 0.0001pt;" class="">
<span style="font-size: 14px;" class=""><o:p class=""></o:p></span></div>
<div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Calibri; font-size: 13px; orphans: 2; widows: 2; margin: 0in 0in 0.0001pt;" class="">
<b class=""><span style="color: rgb(5, 144, 51); font-size: 14px;" class="">UNIVERSITY OF NORTH TEXAS SYSTEM<o:p class=""></o:p></span></b></div>
<div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Calibri; font-size: 13px; orphans: 2; widows: 2; margin: 0in 0in 0.0001pt;" class="">
<span style="font-size: 14px;" class=""><b class="">Office:</b> 940.369.7521</span></div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">On Jul 26, 2019, at 11:01 AM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">I know roughly nothing about IPv6 but if the standard is reasonably explicit about what to do then I'm quite comfortable treating it as a bug.<br class="">
<br class="">
It's odd that the Shibboleth SP doesn't notice this though, so I'd have to look into why. Perhaps the brackets are the norm when reading REMOTE_ADDR anyway. So the problem is that I suspect if we "fix" this it will just break our SP in the bargain without patches
there.<br class="">
<br class="">
-- Scott<br class="">
<br class="">
<br class="">
-- <br class="">
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7C7a7fcd024c734905000d08d711e2c71a%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C636997538007850965&sdata=6JokxKU%2Bdl89VfdC1JnA5SrzgFQMycnLlUpPkLiCLYk%3D&reserved=0" class="">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7C7a7fcd024c734905000d08d711e2c71a%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C636997538007850965&sdata=6JokxKU%2Bdl89VfdC1JnA5SrzgFQMycnLlUpPkLiCLYk%3D&reserved=0</a><br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a><br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
-- <br class="">
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" class="">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
<span style="font-size: 9.0pt; font-family: 'Calibri'; "><em><strong><br>
Important Notice:</strong> The contents of this email are intended solely for the named addressee and are confidential; any unauthorised use, reproduction or storage of the contents is expressly prohibited. If you have received this email in error, please delete
it and any attachments immediately and advise the sender by return email or telephone.<br>
<br>
Deakin University does not warrant that this email and any attachments are error or virus free.</em></span>
</body>
</html>