Fix high-severity bug 'application exposed to path traversal attack'

Signed-off-by: Vasyl Razinkov <vasyl.razinkov@est.tech>
Change-Id: I7f4b1e8d083cc39f8e57dcedddecc6af56fdc9c2
Issue-ID: SDC-4169

diff --git a/catalog-be/src/main/webapp/WEB-INF/web.xml b/catalog-be/src/main/webapp/WEB-INF/web.xml
index ca71eee..64763b2 100644 (file)
--- a/catalog-be/src/main/webapp/WEB-INF/web.xml
+++ b/catalog-be/src/main/webapp/WEB-INF/web.xml
@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
-         version="3.0">
+<web-app xmlns="http://java.sun.com/xml/ns/javaee"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
+    version="3.0">
 
     <servlet>
         <servlet-name>jersey</servlet-name>
@@ -77,7 +78,8 @@
     <!-- ECOMP Portal -->
     <servlet>
         <servlet-name>ECOMPServlet</servlet-name>
-        <servlet-class>org.onap.portalsdk.core.onboarding.crossapi.PortalRestAPIProxy</servlet-class>
+        <servlet-class>org.onap.portalsdk.core.onboarding.crossapi.PortalRestAPIProxy
+        </servlet-class>
         <load-on-startup>3</load-on-startup>
         <async-supported>true</async-supported>
     </servlet>
@@ -174,22 +176,22 @@
         <url-pattern>/sdc/*</url-pattern>
     </filter-mapping>
 
-<!--
-    <filter>
-        <filter-name>basicAuthFilter</filter-name>
-        <filter-class>
-            org.openecomp.sdc.be.filters.BasicAuthenticationFilter
-        </filter-class>
-        <init-param>
-            <param-name>excludedUrls</param-name>
-            <param-value>/sdc2/rest/healthCheck,/sdc2/rest/v1/user,/sdc2/rest/v1/user/jh0003,/sdc2/rest/v1/screen,/sdc2/rest/v1/consumers,/sdc2/rest/v1/catalog/uploadType/datatypes,/sdc2/rest/v1/catalog/upload/multipart</param-value>
-        </init-param>
-    </filter>
+    <!--
+        <filter>
+            <filter-name>basicAuthFilter</filter-name>
+            <filter-class>
+                org.openecomp.sdc.be.filters.BasicAuthenticationFilter
+            </filter-class>
+            <init-param>
+                <param-name>excludedUrls</param-name>
+                <param-value>/sdc2/rest/healthCheck,/sdc2/rest/v1/user,/sdc2/rest/v1/user/jh0003,/sdc2/rest/v1/screen,/sdc2/rest/v1/consumers,/sdc2/rest/v1/catalog/uploadType/datatypes,/sdc2/rest/v1/catalog/upload/multipart</param-value>
+            </init-param>
+        </filter>
 
-    <filter-mapping>
-        <filter-name>basicAuthFilter</filter-name>
-        <url-pattern>/*</url-pattern>
-    </filter-mapping>-->
+        <filter-mapping>
+            <filter-name>basicAuthFilter</filter-name>
+            <url-pattern>/*</url-pattern>
+        </filter-mapping>-->
 
     <!--    <filter>-->
     <!--        <filter-name>beRestrictionAccessFilter</filter-name>-->
@@ -252,6 +254,11 @@
         <param-value>org.openecomp.sdc.be.togglz.TogglzConfiguration</param-value>
     </context-param>
 
+    <context-param>
+        <param-name>org.eclipse.jetty.servlet.Default.dirAllowed</param-name>
+        <param-value>false</param-value>
+    </context-param>
+
     <listener>
         <listener-class>org.openecomp.sdc.be.listen.BEAppContextListener</listener-class>
     </listener>

diff --git a/catalog-fe/src/main/webapp/WEB-INF/web.xml b/catalog-fe/src/main/webapp/WEB-INF/web.xml
index 8f64a2b..de133ac 100644 (file)
--- a/catalog-fe/src/main/webapp/WEB-INF/web.xml
+++ b/catalog-fe/src/main/webapp/WEB-INF/web.xml
@@ -1,115 +1,121 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
-       version="3.0">
-
-       <servlet>
-               <servlet-name>jersey</servlet-name>
-               <servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
-               <init-param>
-                       <param-name>jersey.config.server.provider.packages</param-name>
-                       <param-value>org.openecomp.sdc.fe.servlets</param-value>
-               </init-param>
-
-               <init-param>
-                       <param-name>jersey.config.server.provider.classnames</param-name>
-                       <param-value>org.glassfish.jersey.media.multipart.MultiPartFeature</param-value>
-               </init-param>
-               <init-param>
-                       <param-name>com.sun.jersey.api.json.POJOMappingFeature</param-name>
-                       <param-value>true</param-value>
-               </init-param>
-               <load-on-startup>1</load-on-startup>
-               <async-supported>true</async-supported>
-       </servlet>
-
-       <servlet-mapping>
-               <servlet-name>jersey</servlet-name>
-               <url-pattern>/rest/*</url-pattern>
-       </servlet-mapping>
-
-       <servlet>
-               <servlet-name>ViewStatusMessages</servlet-name>
-               <servlet-class>ch.qos.logback.classic.ViewStatusMessagesServlet</servlet-class>
+<web-app xmlns="http://java.sun.com/xml/ns/javaee"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
+    version="3.0">
+
+    <servlet>
+        <servlet-name>jersey</servlet-name>
+        <servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
+        <init-param>
+            <param-name>jersey.config.server.provider.packages</param-name>
+            <param-value>org.openecomp.sdc.fe.servlets</param-value>
+        </init-param>
+
+        <init-param>
+            <param-name>jersey.config.server.provider.classnames</param-name>
+            <param-value>org.glassfish.jersey.media.multipart.MultiPartFeature</param-value>
+        </init-param>
+        <init-param>
+            <param-name>com.sun.jersey.api.json.POJOMappingFeature</param-name>
+            <param-value>true</param-value>
+        </init-param>
+        <load-on-startup>1</load-on-startup>
         <async-supported>true</async-supported>
-       </servlet>
-
-       <servlet-mapping>
-               <servlet-name>ViewStatusMessages</servlet-name>
-               <url-pattern>/lbClassicStatus</url-pattern>
-       </servlet-mapping>
-
-       <!-- Fe Proxy Servlet -->
-       <servlet>
-               <servlet-name>FeProxy</servlet-name>
-               <servlet-class>org.openecomp.sdc.fe.servlets.FeProxyServlet</servlet-class>
-
-               <load-on-startup>1</load-on-startup>
-               <async-supported>true</async-supported>
-
-
-       </servlet>
-
-       <servlet-mapping>
-               <servlet-name>FeProxy</servlet-name>
-               <url-pattern>/feProxy/*</url-pattern>
-       </servlet-mapping>
-
-       <servlet>
-               <servlet-name>Portal</servlet-name>
-               <servlet-class>org.openecomp.sdc.fe.servlets.PortalServlet</servlet-class>
-               <async-supported>true</async-supported>
-       </servlet>
-
-       <servlet-mapping>
-               <servlet-name>Portal</servlet-name>
-               <url-pattern>/portal</url-pattern>
-       </servlet-mapping>
-
-       
-       <filter>
-               <filter-name>AuditLogServletFilter</filter-name>
-               <filter-class>org.onap.logging.filter.base.AuditLogServletFilter</filter-class>
-               <async-supported>true</async-supported>
-       </filter>
-
-<!--   <filter>-->
-<!--           <filter-name>SecurityFilter</filter-name>-->
-<!--           <filter-class>org.openecomp.sdc.fe.filters.SecurityFilter</filter-class>-->
-<!--        <async-supported>true</async-supported>-->
-<!--        <init-param>-->
-<!--            <param-name>excludedUrls</param-name>-->
-<!--            &lt;!&ndash; Comma separated list of excluded servlet URLs  &ndash;&gt;-->
-<!--            <param-value>/config,/configmgr,/rest</param-value>-->
-<!--        </init-param>-->
-<!--   </filter>-->
-
-        <filter>
-          <filter-name>gzipFilter</filter-name>
-          <filter-class>org.openecomp.sdc.fe.filters.GzipFilter</filter-class>
-       <async-supported>true</async-supported>
-        </filter>
-
-       <filter-mapping>
-               <filter-name>AuditLogServletFilter</filter-name>
-               <url-pattern>/*</url-pattern>
-       </filter-mapping>
-
-<!--   <filter-mapping>-->
-<!--           <filter-name>SecurityFilter</filter-name>-->
-<!--           <url-pattern>/*</url-pattern>-->
-<!--    </filter-mapping>-->
-
-       <filter-mapping>
-               <filter-name>gzipFilter</filter-name>
-               <url-pattern>*.jsgz</url-pattern>
-       </filter-mapping>
-
-       <listener>
-               <listener-class>org.openecomp.sdc.fe.listen.FEAppContextListener</listener-class>
-       </listener>
-
-       <welcome-file-list>
-               <welcome-file>index.html</welcome-file>
-       </welcome-file-list>
+    </servlet>
+
+    <servlet-mapping>
+        <servlet-name>jersey</servlet-name>
+        <url-pattern>/rest/*</url-pattern>
+    </servlet-mapping>
+
+    <servlet>
+        <servlet-name>ViewStatusMessages</servlet-name>
+        <servlet-class>ch.qos.logback.classic.ViewStatusMessagesServlet</servlet-class>
+        <async-supported>true</async-supported>
+    </servlet>
+
+    <servlet-mapping>
+        <servlet-name>ViewStatusMessages</servlet-name>
+        <url-pattern>/lbClassicStatus</url-pattern>
+    </servlet-mapping>
+
+    <!-- Fe Proxy Servlet -->
+    <servlet>
+        <servlet-name>FeProxy</servlet-name>
+        <servlet-class>org.openecomp.sdc.fe.servlets.FeProxyServlet</servlet-class>
+
+        <load-on-startup>1</load-on-startup>
+        <async-supported>true</async-supported>
+
+
+    </servlet>
+
+    <servlet-mapping>
+        <servlet-name>FeProxy</servlet-name>
+        <url-pattern>/feProxy/*</url-pattern>
+    </servlet-mapping>
+
+    <servlet>
+        <servlet-name>Portal</servlet-name>
+        <servlet-class>org.openecomp.sdc.fe.servlets.PortalServlet</servlet-class>
+        <async-supported>true</async-supported>
+    </servlet>
+
+    <servlet-mapping>
+        <servlet-name>Portal</servlet-name>
+        <url-pattern>/portal</url-pattern>
+    </servlet-mapping>
+
+    <context-param>
+        <param-name>org.eclipse.jetty.servlet.Default.dirAllowed</param-name>
+        <param-value>false</param-value>
+    </context-param>
+
+
+    <filter>
+        <filter-name>AuditLogServletFilter</filter-name>
+        <filter-class>org.onap.logging.filter.base.AuditLogServletFilter</filter-class>
+        <async-supported>true</async-supported>
+    </filter>
+
+    <!--       <filter>-->
+    <!--               <filter-name>SecurityFilter</filter-name>-->
+    <!--               <filter-class>org.openecomp.sdc.fe.filters.SecurityFilter</filter-class>-->
+    <!--        <async-supported>true</async-supported>-->
+    <!--        <init-param>-->
+    <!--            <param-name>excludedUrls</param-name>-->
+    <!--            &lt;!&ndash; Comma separated list of excluded servlet URLs  &ndash;&gt;-->
+    <!--            <param-value>/config,/configmgr,/rest</param-value>-->
+    <!--        </init-param>-->
+    <!--       </filter>-->
+
+    <filter>
+        <filter-name>gzipFilter</filter-name>
+        <filter-class>org.openecomp.sdc.fe.filters.GzipFilter</filter-class>
+        <async-supported>true</async-supported>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>AuditLogServletFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+
+    <!--       <filter-mapping>-->
+    <!--               <filter-name>SecurityFilter</filter-name>-->
+    <!--               <url-pattern>/*</url-pattern>-->
+    <!--    </filter-mapping>-->
+
+    <filter-mapping>
+        <filter-name>gzipFilter</filter-name>
+        <url-pattern>*.jsgz</url-pattern>
+    </filter-mapping>
+
+    <listener>
+        <listener-class>org.openecomp.sdc.fe.listen.FEAppContextListener</listener-class>
+    </listener>
+
+    <welcome-file-list>
+        <welcome-file>index.html</welcome-file>
+    </welcome-file-list>
 </web-app>

diff --git a/dox-sequence-diagram-ui/src/main/webapp/WEB-INF/web.xml b/dox-sequence-diagram-ui/src/main/webapp/WEB-INF/web.xml
index c723615..01ca867 100644 (file)
--- a/dox-sequence-diagram-ui/src/main/webapp/WEB-INF/web.xml
+++ b/dox-sequence-diagram-ui/src/main/webapp/WEB-INF/web.xml
@@ -1,14 +1,18 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <web-app id="Amdocs_ES6_Blueprint" version="3.0"
-    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xmlns="http://java.sun.com/xml/ns/javaee"
     xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
 
-       <display-name>Amdocs ES6 Blueprint</display-name>
+    <display-name>Amdocs ES6 Blueprint</display-name>
 
-       <welcome-file-list>
-               <welcome-file>index.html</welcome-file>
-       </welcome-file-list>
+    <welcome-file-list>
+        <welcome-file>index.html</welcome-file>
+    </welcome-file-list>
+    <context-param>
+        <param-name>org.eclipse.jetty.servlet.Default.dirAllowed</param-name>
+        <param-value>false</param-value>
+    </context-param>
 
 </web-app>
 

diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/notifications-fe/src/main/webapp/WEB-INF/web.xml b/openecomp-be/api/openecomp-sdc-rest-webapp/notifications-fe/src/main/webapp/WEB-INF/web.xml
index f0bad66..9191a35 100644 (file)
--- a/openecomp-be/api/openecomp-sdc-rest-webapp/notifications-fe/src/main/webapp/WEB-INF/web.xml
+++ b/openecomp-be/api/openecomp-sdc-rest-webapp/notifications-fe/src/main/webapp/WEB-INF/web.xml
@@ -1,8 +1,8 @@
 <web-app
-        xmlns="http://java.sun.com/xml/ns/javaee"
-        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-        xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
-        version="3.0">
+    xmlns="http://java.sun.com/xml/ns/javaee"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
+    version="3.0">
 
 
     <!-- Spring -->
@@ -79,6 +79,11 @@
         <load-on-startup>1</load-on-startup>
     </servlet>
 
+    <context-param>
+        <param-name>org.eclipse.jetty.servlet.Default.dirAllowed</param-name>
+        <param-value>false</param-value>
+    </context-param>
+
     <servlet-mapping>
         <servlet-name>spring-mapper</servlet-name>
         <url-pattern>/ws/*</url-pattern>

diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/onboarding-rest-war/src/main/webapp/WEB-INF/web.xml b/openecomp-be/api/openecomp-sdc-rest-webapp/onboarding-rest-war/src/main/webapp/WEB-INF/web.xml
index 09d2fb1..3cbfb13 100644 (file)
--- a/openecomp-be/api/openecomp-sdc-rest-webapp/onboarding-rest-war/src/main/webapp/WEB-INF/web.xml
+++ b/openecomp-be/api/openecomp-sdc-rest-webapp/onboarding-rest-war/src/main/webapp/WEB-INF/web.xml
@@ -1,8 +1,8 @@
 <web-app
-        xmlns="http://java.sun.com/xml/ns/javaee"
-        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-        xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
-        version="3.0">
+    xmlns="http://java.sun.com/xml/ns/javaee"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
+    version="3.0">
 
 
     <!-- Spring -->
@@ -16,7 +16,10 @@
         <param-value>org.openecomp.sdc.be.togglz.TogglzConfiguration</param-value>
     </context-param>
 
-
+    <context-param>
+        <param-name>org.eclipse.jetty.servlet.Default.dirAllowed</param-name>
+        <param-value>false</param-value>
+    </context-param>
 
     <listener>
         <listener-class>org.openecomp.server.listeners.OnboardingAppStartupListener</listener-class>

diff --git a/openecomp-ui/webapp-heat-validation/WEB-INF/web.xml b/openecomp-ui/webapp-heat-validation/WEB-INF/web.xml
index f84519e..013ab32 100644 (file)
--- a/openecomp-ui/webapp-heat-validation/WEB-INF/web.xml
+++ b/openecomp-ui/webapp-heat-validation/WEB-INF/web.xml
@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="ISO-8859-1"?>
 <web-app xmlns="http://java.sun.com/xml/ns/javaee"
-         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
-         version="3.0">
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
+    version="3.0">
 
     <display-name>Heat-Validation</display-name>
 
@@ -24,6 +24,11 @@
         </init-param>
     </servlet>
 
+    <context-param>
+        <param-name>org.eclipse.jetty.servlet.Default.dirAllowed</param-name>
+        <param-value>false</param-value>
+    </context-param>
+
     <servlet-mapping>
         <servlet-name>js</servlet-name>
         <url-pattern>*.js</url-pattern>

diff --git a/openecomp-ui/webapp-onboarding/WEB-INF/web.xml b/openecomp-ui/webapp-onboarding/WEB-INF/web.xml
index 7840279..65b2bc4 100644 (file)
--- a/openecomp-ui/webapp-onboarding/WEB-INF/web.xml
+++ b/openecomp-ui/webapp-onboarding/WEB-INF/web.xml
@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="ISO-8859-1"?>
 <web-app xmlns="http://java.sun.com/xml/ns/javaee"
-         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
-         version="3.0">
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
+    version="3.0">
 
     <display-name>ASDC</display-name>
 
@@ -29,6 +29,11 @@
         <url-pattern>*.js</url-pattern>
     </servlet-mapping>
 
+    <context-param>
+        <param-name>org.eclipse.jetty.servlet.Default.dirAllowed</param-name>
+        <param-value>false</param-value>
+    </context-param>
+
     <servlet>
         <servlet-name>resources</servlet-name>
         <servlet-class>org.eclipse.jetty.servlet.DefaultServlet</servlet-class>

diff --git a/utils/webseal-simulator/src/main/webapp/WEB-INF/web.xml b/utils/webseal-simulator/src/main/webapp/WEB-INF/web.xml
index 7535e1b..a293d3c 100644 (file)
--- a/utils/webseal-simulator/src/main/webapp/WEB-INF/web.xml
+++ b/utils/webseal-simulator/src/main/webapp/WEB-INF/web.xml
@@ -1,40 +1,46 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
-       version="3.0">
-       
-       <display-name>Archetype Created Web Application</display-name>
-
-       <servlet>
-               <servlet-name>Proxy</servlet-name>
-               <servlet-class>org.openecomp.sdc.webseal.simulator.SdcProxy</servlet-class>
-       </servlet>
-       <servlet-mapping>
-               <servlet-name>Proxy</servlet-name>
-               <url-pattern>/*</url-pattern>
-       </servlet-mapping>
-
-       <servlet>
-               <servlet-name>Login</servlet-name>
-               <servlet-class>org.openecomp.sdc.webseal.simulator.Login</servlet-class>
-       </servlet>
-       <servlet-mapping>
-               <servlet-name>Login</servlet-name>
-               <url-pattern>/login</url-pattern>
-       </servlet-mapping>
-       
-       <servlet>
-               <servlet-name>CreateUser</servlet-name>
-               <servlet-class>org.openecomp.sdc.webseal.simulator.RequestsClient</servlet-class>
-       </servlet>
-       <servlet-mapping>
-               <servlet-name>CreateUser</servlet-name>
-               <url-pattern>/create</url-pattern>
-       </servlet-mapping>
-       
-       <welcome-file-list>
-               <welcome-file>login</welcome-file>
-       </welcome-file-list>
+<web-app xmlns="http://java.sun.com/xml/ns/javaee"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
+    version="3.0">
+
+    <display-name>Archetype Created Web Application</display-name>
+
+    <servlet>
+        <servlet-name>Proxy</servlet-name>
+        <servlet-class>org.openecomp.sdc.webseal.simulator.SdcProxy</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>Proxy</servlet-name>
+        <url-pattern>/*</url-pattern>
+    </servlet-mapping>
+
+    <context-param>
+        <param-name>org.eclipse.jetty.servlet.Default.dirAllowed</param-name>
+        <param-value>false</param-value>
+    </context-param>
+
+    <servlet>
+        <servlet-name>Login</servlet-name>
+        <servlet-class>org.openecomp.sdc.webseal.simulator.Login</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>Login</servlet-name>
+        <url-pattern>/login</url-pattern>
+    </servlet-mapping>
+
+    <servlet>
+        <servlet-name>CreateUser</servlet-name>
+        <servlet-class>org.openecomp.sdc.webseal.simulator.RequestsClient</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>CreateUser</servlet-name>
+        <url-pattern>/create</url-pattern>
+    </servlet-mapping>
+
+    <welcome-file-list>
+        <welcome-file>login</welcome-file>
+    </welcome-file-list>
 
 </web-app>