exclude a directory from X.509 client authentication

[Peter Schober]

* ssn at ebi.ac.uk <ssn at ebi.ac.uk> [2016-03-02 17:15]:
> Please can get I some advice how to reconfigure tomcat to not enable X.509
> client authentication on a specific directory (if possible?), when our IdP
> is selected a user's web browser might pop up a message asking for the
> user's client certificate even though the user hasn't yet chosen any IdP to
> login. This happens because the web browser fetches our logos from
> https://idp.ebi.ac.uk (https://idp.ebi.ac.uk/images/EMBL_EBI_logo_95x30.png)

Note that there is no authentication required to access that image:

$ curl -v -s https://idp.ebi.ac.uk/images/EMBL_EBI_logo_95x30.png 2>&1| grep '^< HTTP'
< HTTP/1.1 200 OK

> - If there is away to exclude the directory from X.509 authentication this
> should solve this issue.

Your IDP runs in the https://idp.ebi.ac.uk/idp/ context (which does
not overlap with /images/), but not even with the IDP context every
URL requires authentication,
e.g. https://idp.ebi.ac.uk/idp/images/dummylogo.png

So (1) I can't reproduce the problem you say you're having, and (2)
something running outside the IDP by defintion is nothing the
Shibboleth software can help you with.
I'd say whatever you changed in Tomcat to make require client cert
authentication, that's where you'd need to be more specific.
-peter