Using IPv6-only address as advanced auth API end-point fails

[tvogel]

Following up from #27: Since the fix supporting https for the advanced auth api end-point, IPv6 addresses cannot be resolved anymore.

I made a reproducing setup here:

https://github.com/tvogel/orthanc-setup-samples/tree/tv/auth-api-ipv6-problem

It enables IPv6 in docker-compose, writes the IPv6 address of the auth-service into a separate entry in /etc/hosts as auth-service-v6 and tries to use that address which unfortunately fails.

Instructions:

1. Clone the repo (or fetch it into yours) and check out that branch
2. Go to docker/access-control and run docker compose up --build
3. Run curl -v -H "api-key: key-1" 'http://localhost/orthanc-clients/dicom-web/studies?PatientID=*'
4. Observe that you get HTTP/1.1 403 Forbidden
5. In the compose output, you'll find:

   HTTP-0 OrthancException.cpp:62] Error in the network protocol: libCURL error: Could not resolve hostname while accessing http://auth-service-v6:8000/auth/validate
   

For contrast:

1. In docker/access-control/orthanc/auth.jsonc revert back to using auth-service instead of auth-service-v6.
2. Stop docker compose and run docker compose up --build again.
3. Try again
4. See that curl now succeeds to retrieve results.

Please note that I had to make a small unrelated fix in 6a1344 which might be of use regardless of this issue.

[amazy]

"unrelated" note: DCMTK fully supports ipv6 as of 3.7.0 (announce) -> good to check ipv6 for DICOM too once we work on this topic ...

[amazy]

Hi @tvogel

Some investigations notes:

• In order for the auth-service to listen on IP v6, it seems we need to replace "0.0.0.0" by "::" in CMD ["uvicorn", "app:app", "--host", "::", "--port" , "8000"]
• If I docker exec into one of the orthanc containers and install curl, I can call curl -v http://auth-service-v6:8000/users/1
• Orthanc actually uses a statically linked curl library (not the system one)

-> this commit should fix it (it works on my dev machine)

Can you test again with the mainline binaries once they are available ?

[tvogel]

Is there an easy way to get the mainline binaries into a Docker image?

[amazy]

[tvogel]

Yes, I can confirm, it works with orthancteam/orthanc-pre-release:master-full-unstable after adjusting the CMD for auth-service as you pointed out!

Thanks a lot! When will this appear in the release builds?

By the way, I just found out, uvicorn supports dual-stack by passing the empty string as host, so

CMD ["uvicorn", "app:app", "--host", "", "--port" , "8000"]

works fine for both IP versions.

[jodogne]

Hello,

Thanks for the confirmation.

When will this appear in the release builds?

Not before March 2026. My academic responsibilities do not allow me to spend a full day running the detailed quality control procedure for Orthanc in the coming weeks.

Regards,
Sébastien-

[tvogel]

No worries, I was just curious when I should check back. We have a workaround in place! Thanks again!