Request paths served without Kerberos negotiation, one per line. A path matches itself and everything below it, so /login covers /login/foo but not /loginSomethingElse.

Paths Jenkins core already serves anonymously — /login, /logout, /adjuncts/*, /tcpSlaveAgentListener and the unprotected root actions such as /health and /whoAmI — are exempt automatically and need not be listed.

The one case that does need listing is /login when Allow anonymous access is enabled. That option makes /login the only way for a user to explicitly trigger Kerberos negotiation, so it keeps answering 401. Inbound agents refuse to connect against that: the remoting agent probes GET /login before every connection attempt and requires a 200. Adding /login here restores those agents, at the cost of the explicit SSO login entry point.

Listing a path only skips Kerberos negotiation for it. It grants no permissions — Jenkins' own authorization still applies to the resulting anonymous request.