We are using the saml2api in an application in which all pages are open (basically, we're using the API for personalization, and not for access control). This means that we have to list every single page in the saml2api_openPages which is of course awkward. If the parameter supported * patterns in the same way that servlet mappings do, that would help enormously.