Solved: exclude a directory from X.509 client authentication

[ssn at ebi.ac.uk]

On 02/03/16 16:14, ssn at ebi.ac.uk wrote:
> Hi
>
> Please can get I some advice how to reconfigure tomcat to not enable 
> X.509 client authentication on a specific directory (if possible?), 
> when our IdP is selected a user's web browser might pop up a message 
> asking for the user's client certificate even though the user hasn't 
> yet chosen any IdP to login. This happens because the web browser 
> fetches our logos from https://idp.ebi.ac.uk 
> (https://idp.ebi.ac.uk/images/EMBL_EBI_logo_95x30.png) - If there is 
> away to exclude the directory from X.509 authentication this should 
> solve this issue.
>
> Any further clarification please let me know.
>
> Thanks

The issue we were experiencing was solved in server.xml Connector 
port="9443"

Having clientAuth=true was causing the client's browser to request a 
certificate when accessing logos, with the help of UkF it identified 
this needed changing to clientAuth=false

<Connector port="9443" protocol="HTTP/1.1" SSLEnabled="true"
                 maxThreads="150" scheme="https" secure="true"
                 clientAuth="false"
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160316/79a5476c/attachment.html>