# Airlock port-4401 ext-prefix wildcard reconciliation
# Date: 2026-11-11

## Scope

- `https://mein-portal.baloise.de:4401`
- `https://va.baloise.de:4401`

## Result

The listeners apply their application authentication handoff to arbitrary paths. The previously named `/ext-login` and `/ext-admin` examples are therefore not evidence of distinct application handlers, API definitions, actuator routes, one-shot login handlers, SAML metadata exporters or administration APIs.

- Mein Portal returns Apache HTTP 303 to `/auth/login?Location=...` and preserves the requested path in `Location`.
- VA returns Apache HTTP 303 to `/auth/check-login?Location=...` and preserves the requested path in `Location`.
- On each host, the response class is identical for plausible names, impossible controls under `/ext-login` and `/ext-admin`, and an impossible root-level control.
- The canonical Mein Portal VENTA/Airlock and VA SAS/Airlock route graphs remain authoritative. No additional ext-prefix route family is retained.

## Captured parity controls

Mein Portal:

- plausible `/ext-login/ui/app`: `01a1cb15-e3e9-763a-8456-28b4449471fc`
- plausible `/ext-login/rest/public/application.wadl`: `01a1cb15-e6d4-70bb-bcdf-16cee7b0707f`
- plausible `/ext-login/actuator`: `01a1cb15-e7fe-737c-8045-ec6f783b6069`
- plausible `/ext-login/login-oneshot`: `01a1cb15-e90c-7228-813b-c5da66d6a9c6`
- impossible `/ext-login/this-path-must-not-exist-14269251`: `01a1cb15-ea36-77f7-a00f-cec1085c30f2`
- plausible `/ext-admin/rest/users`: `01a1cb15-eb79-712d-bf3f-48ebaa7cd6d6`
- impossible `/ext-admin/this-path-must-not-exist-14269251`: `01a1cb15-ec91-73c9-888e-9fa5b44f8542`
- impossible root control: `01a1cb15-ed8c-75f0-92c2-72b740696668`

VA:

- plausible `/ext-login/ui/app`: `01a1cb15-efa9-7169-9a22-98e5e9a9b24f`
- plausible `/ext-login/rest/public/application.wadl`: `01a1cb15-f0a7-75f9-9cc2-1f4f9a46b818`
- plausible `/ext-login/actuator`: `01a1cb15-f198-7791-b538-fbe90397b30c`
- plausible `/ext-login/login-oneshot`: `01a1cb15-f28a-7796-bc50-2137696fc583`
- impossible `/ext-login/this-path-must-not-exist-14269251`: `01a1cb15-f393-7344-a6c4-ee86f4cc197d`
- plausible `/ext-admin/rest/users`: `01a1cb15-f488-74d4-ac27-b5e8eaa67170`
- impossible `/ext-admin/this-path-must-not-exist-14269251`: `01a1cb15-f5a5-7758-9a26-27232da469d0`
- impossible root control: `01a1cb15-f6ab-7036-97bb-f2139cefdc20`

## Reconciliation

Earlier response observations remain accurate, but their interpretation as endpoint parity is replaced by the listener-wide wildcard classification above.