Wow. Maybe 3 hours of work, mostly just thinking time, about 10 lines of new code, and another 10 lines of Spring config added to the existing SSO profile, and ECP is working. Also verified it works without container authentication, if the test script volunteers the basic-auth header. -- Scott