Is there a way in Shibboleth IdP V5 to disable all the access controls?

[Peter Schober]

o haya via users <users at shibboleth.net> [2025-03-27 08:45 CET]:
> I've been googling and google is returning some results that
> indicate that there are ways to disable the IdP access controls.

Note that you don't even have to use those IDP features that require
access control (such as the "Hello world" page), in your case those
are simply somewhat artificial stand-ins for actual resources you want
to protect.
I.e., moving on with your testing by adding Service Providers will
also avoid having to deal with the IDP's internal access controls.
(Up to you to decide what's easier going forward.)

But it's not that hard to configure an access policy that's wide open
(essentially turning it off), e.g. based on
shibboleth.IPRangeAccessControl and supplying an IP range in CIDR
notation that matches all relevant (or even all possible) IPv4
addresses.

You define/configure a policy in conf/access-control.xml

  ...
  <entry key="AccessByIPAddress">
    <bean id="AccessByIPAddress" parent="shibboleth.IPRangeAccessControl"
      p:allowedRanges="#{ {'127.0.0.1/32', '::1/128'} }" />
    </entry>
  </entry>
  ...

and reference it by name within conf/admin/admin.properties for the
feature you want to protect, e.g.

idp.hello.accessPolicy = AccessByIPAddress

HTH,
-peter