Put optional paths before protected paths, or else it won't work right; Avoid making /Shibboleth.sso and /shibboleth-sp themselves shib-protected; Make remote_user_attributes configurable by attribute