<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">There was this issue noted about Tomcat and web.xml with similar impact:<div class=""><br class=""></div><div class=""> <a href="https://issues.shibboleth.net/jira/browse/IDP-1382" class="">https://issues.shibboleth.net/jira/browse/IDP-1382</a> <br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Apr 20, 2020, at 5:30 PM, Paul B. Henson <<a href="mailto:henson@cpp.edu" class="">henson@cpp.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><blockquote type="cite" class="">From: Cantor, Scott<br class="">Sent: Monday, April 20, 2020 3:07 PM<br class=""><br class="">Could be. Says that's supported since Servlet 3.0, which is old enough. You're<br class="">welcome to file a bug.<br class=""></blockquote><br class="">Cool, thanks. It looks like another option would be something like below, denying everything explicitly, then one allow with limited methods for the non-API URLs, and a separate one for the API URLs with no methods listed. Any preference for which approach would be better? Do the non-API URLs need any methods other than GET/POST enabled? Maybe HEAD?<br class=""><br class=""><security-constraint><br class=""> <display-name><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>Deny everything <br class=""> </display-name><br class=""> <web-resource-collection><br class=""> <url-pattern>/</url-pattern><br class=""> </web-resource-collection><br class=""> <auth-constraint/><br class=""></security-constraint><br class=""><br class=""> <security-constraint> <br class=""> <web-resource-collection> <br class=""> <web-resource-name>Non-API Content</web-resource-name> <br class=""> <url-pattern>/*</url-pattern> <br class=""> <http-method>GET</http-method> <br class=""> <http-method>POST</http-method> <br class=""> </web-resource-collection> <br class=""> </security-constraint> <br class=""><br class=""><security-constraint> <br class=""> <web-resource-collection> <br class=""> <web-resource-name>Administrative APIs</web-resource-name><br class=""> <url-pattern>/profile/admin/*</url-pattern> <br class=""> </web-resource-collection> <br class=""> <!-- no auth-constraint tag here --> <br class=""></security-constraint> <br class="">-- <br class="">For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" class="">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br class="">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a><br class=""><br class="">----------<br class=""><br class="">This email has been scanned for spam and viruses by Proofpoint Essentials. Visit the following link to report this email as spam:<br class=""><a href="https://us2.proofpointessentials.com/index01.php?mod_id=11&mod_option=logitem&mail_id=1587421880-cSS0Bc1VNBfR&r_address=mgrady%40unicon.net&report=1" class="">https://us2.proofpointessentials.com/index01.php?mod_id=11&mod_option=logitem&mail_id=1587421880-cSS0Bc1VNBfR&r_address=mgrady%40unicon.net&report=1</a><br class=""><br class=""></div></div></blockquote></div><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></div></body></html>