Reports

Have you tried to concatenate the matchers and specify the HttpMethod to reduce the scope of the matcher, like this:

@Bean 
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { 
    LOG.info("SSO is disabled. Continuing using LDAP Authentication."); 

    http.csrf(AbstractHttpConfigurer::disable)
        .authorizeHttpRequests(req -> req.requestMatchers("/login").permitAll())
        .authorizeHttpRequests(
            req ->
                req.requestMatchers(
                        HttpMethod.GET,
                        "/images/**",
                        "/js/**",
                        "/css/**",
                        "/webjars/**",
                        "/resources/**",
                        "/jakarta.faces.resource/**",
                        "/jakarta.faces.resource/images/**")
                    .permitAll());

    return http.build(); 
}

Removing both the anyRequest().permitAll() and the definition of the WebSecurityCustomizer bean?

79119584