diff --git a/app/config/app.php b/app/config/app.php
index e9d05dcb7..fa10ff058 100644
--- a/app/config/app.php
+++ b/app/config/app.php
@@ -351,49 +351,72 @@
     /**
      * Configures logging options
      */
-    'Log' => [
-        'debug' => [
-            'className' => 'Cake\Log\Engine\FileLog',
-            'path' => LOGS,
-            'file' => 'debug',
-            'url' => env('LOG_DEBUG_URL', null),
-            'scopes' => false,
-            'levels' => ['notice', 'info', 'debug'],
-        ],
-        'error' => [
-            'className' => 'Cake\Log\Engine\FileLog',
-            'path' => LOGS,
-            'file' => 'error',
-            'url' => env('LOG_ERROR_URL', null),
-            'scopes' => false,
-            'levels' => ['warning', 'error', 'critical', 'alert', 'emergency'],
-        ],
-        // To enable this dedicated query log, you need set your datasource's log flag to true
-        'queries' => [
-            'className' => 'Cake\Log\Engine\FileLog',
-            'path' => LOGS,
-            'file' => 'queries',
-            'url' => env('LOG_QUERIES_URL', null),
-            'scopes' => ['queriesLog'],
-        ],
-        // We define a trace level for what is really debugging, except debug level
-        // will write to stdout instead of the log when debug=true
-        'trace' => [
-            'className' => 'Cake\Log\Engine\FileLog',
-            'path' => LOGS,
-            'file' => 'trace',
-            'url' => env('LOG_TRACE_URL', null),
-            'scopes' => ['trace'],
-        ],
-        // We define a rules level to record application rule execution
-        'rule' => [
-            'className' => 'Cake\Log\Engine\FileLog',
-            'path' => LOGS,
-            'file' => 'rule',
-            'url' => env('LOG_TRACE_URL', null),
-            'scopes' => ['rule'],
-        ]
-    ],
+    'Log' => null !== env('COMANAGE_REGISTRY_CONTAINER', null)
+             // Configuration for container deployments
+             ? [
+                 'debug' => [
+                     'className' => 'Cake\Log\Engine\ConsoleLog',
+                     'stream' => 'php://stdout',
+                     'outputAs' => 0,
+                     'scopes' => false,
+                     'levels' => ['notice', 'info', 'debug'],
+                 ],
+                 'error' => [
+                     'className' => 'Cake\Log\Engine\ConsoleLog',
+                     'stream' => 'php://stderr',
+                     'outputAs' => 0,
+                     'scopes' => false,
+                     'levels' => ['warning', 'error', 'critical', 'alert', 'emergency'],
+                 ],
+                 'queries' => [
+                     'className' => 'Cake\Log\Engine\ConsoleLog',
+                     'stream' => 'php://stdout',
+                     'outputAs' => 0,
+                     'scopes' => ['queriesLog']
+                 ],
+                 'trace' => [
+                     'className' => 'Cake\Log\Engine\ConsoleLog',
+                     'stream' => 'php://stdout',
+                     'outputAs' => 0,
+                     'scopes' => ['trace'],
+                 ]
+             ]
+             // Configuration for tranditional deployments
+             : [
+                 'debug' => [
+                     'className' => 'Cake\Log\Engine\FileLog',
+                     'path' => LOGS,
+                     'file' => 'debug',
+                     'url' => env('LOG_DEBUG_URL', null),
+                     'scopes' => false,
+                     'levels' => ['notice', 'info', 'debug'],
+                 ],
+                 'error' => [
+                     'className' => 'Cake\Log\Engine\FileLog',
+                     'path' => LOGS,
+                     'file' => 'error',
+                     'url' => env('LOG_ERROR_URL', null),
+                     'scopes' => false,
+                     'levels' => ['warning', 'error', 'critical', 'alert', 'emergency'],
+                 ],
+                 // To enable this dedicated query log, you need set your datasource's log flag to true
+                 'queries' => [
+                     'className' => 'Cake\Log\Engine\FileLog',
+                     'path' => LOGS,
+                     'file' => 'queries',
+                     'url' => env('LOG_QUERIES_URL', null),
+                     'scopes' => ['queriesLog'],
+                 ],
+                 // We define a trace level for what is really debugging, except debug level
+                 // will write to stdout instead of the log when debug=true
+                 'trace' => [
+                     'className' => 'Cake\Log\Engine\FileLog',
+                     'path' => LOGS,
+                     'file' => 'trace',
+                     'url' => env('LOG_TRACE_URL', null),
+                     'scopes' => ['trace'],
+                 ]
+               ],
 
     /**
      * Session configuration.
diff --git a/app/resources/locales/en_US/field.po b/app/resources/locales/en_US/field.po
index c11e25e06..0f88b28e3 100644
--- a/app/resources/locales/en_US/field.po
+++ b/app/resources/locales/en_US/field.po
@@ -315,6 +315,9 @@ msgstr "Limit Global Search Scope"
 msgid "CoSettings.search_global_limited_models.desc"
 msgstr "If true, Global Search will only search Names, Email Addresses, and Identifiers. This may result in faster searches for larger deployments."
 
+msgid "format"
+msgstr "format"
+
 msgid "GroupMembers.source"
 msgstr "Membership Source"
 
diff --git a/app/resources/locales/en_US/information.po b/app/resources/locales/en_US/information.po
index 4cd7ed3a2..f129fe850 100644
--- a/app/resources/locales/en_US/information.po
+++ b/app/resources/locales/en_US/information.po
@@ -51,6 +51,12 @@ msgstr "Active, Cannot Be Disabled"
 msgid "plugin.inactive"
 msgstr "Inactive"
 
+msgid "global.attribute.modal"
+msgstr "Attribute Modal"
+
+msgid "global.attributes"
+msgstr "Attributes"
+
 msgid "global.records.none"
 msgstr "There are no records to display."
 
diff --git a/app/resources/locales/en_US/menu.po b/app/resources/locales/en_US/menu.po
index d15a079c4..c66dfff37 100644
--- a/app/resources/locales/en_US/menu.po
+++ b/app/resources/locales/en_US/menu.po
@@ -141,6 +141,9 @@ msgstr "All Groups"
 msgid "co.switch"
 msgstr "Switch CO"
 
+msgid "menu.user"
+msgstr "User Menu"
+
 msgid "registries"
 msgstr "Available {0} Registries"
 
diff --git a/app/src/Command/SetupCommand.php b/app/src/Command/SetupCommand.php
index ee80da1ad..c6845e434 100644
--- a/app/src/Command/SetupCommand.php
+++ b/app/src/Command/SetupCommand.php
@@ -160,7 +160,7 @@ public function execute(Arguments $args, ConsoleIo $io)
     
     $person->person_roles = [$coTable->People->PersonRoles->newEntity([
       'affiliation_type_id'   => $coTable->Types->getTypeId(coId:       $co_id, 
-                                                            attribute:  'PersonRoles.affiliation',
+                                                            attribute:  'PersonRoles.affiliation_type',
                                                             value:      'staff'),
       'title'                 => __d('command', 'se.person_role.title'),
       'status'                => SuspendableStatusEnum::Active
diff --git a/app/src/Controller/StandardController.php b/app/src/Controller/StandardController.php
index f88cd1eaa..fb3ffce55 100644
--- a/app/src/Controller/StandardController.php
+++ b/app/src/Controller/StandardController.php
@@ -173,6 +173,11 @@ public function beforeRender(\Cake\Event\EventInterface $event) {
     }
 
     $this->set('vv_template_path', $vv_template_path);
+  
+    // Check to see if the model names a specific layout
+    if(method_exists($table, "getLayout")) {
+       $this->viewBuilder()->setLayout($table->getLayout());
+    }
 
     return parent::beforeRender($event);
   }
diff --git a/app/src/Model/Table/AdHocAttributesTable.php b/app/src/Model/Table/AdHocAttributesTable.php
index c0b95f022..d194d8a80 100644
--- a/app/src/Model/Table/AdHocAttributesTable.php
+++ b/app/src/Model/Table/AdHocAttributesTable.php
@@ -43,6 +43,26 @@ class AdHocAttributesTable extends Table {
   use \App\Lib\Traits\ValidationTrait;
   use \App\Lib\Traits\SearchFilterTrait;
   
+  /**
+   * Provide the default layout
+   *
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getLayout(): string {
+    return "iframe";
+  }
+  
+  /**
+   * Provide the default redirect goal
+   *
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getRedirectGoal(): string {
+    return "self";
+  }
+  
   /**
    * Perform Cake Model initialization.
    *
diff --git a/app/src/Model/Table/AddressesTable.php b/app/src/Model/Table/AddressesTable.php
index e81d5e2f1..a49b0b39e 100644
--- a/app/src/Model/Table/AddressesTable.php
+++ b/app/src/Model/Table/AddressesTable.php
@@ -58,6 +58,26 @@ class AddressesTable extends Table {
     ]
   ];
   
+  /**
+   * Provide the default layout
+   *
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getLayout(): string {
+    return "iframe";
+  }
+  
+  /**
+   * Provide the default redirect goal
+   *   
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getRedirectGoal(): string {
+    return "self";
+  }
+  
   /**
    * Perform Cake Model initialization.
    *
diff --git a/app/src/Model/Table/EmailAddressesTable.php b/app/src/Model/Table/EmailAddressesTable.php
index c8a21fa54..52adb0068 100644
--- a/app/src/Model/Table/EmailAddressesTable.php
+++ b/app/src/Model/Table/EmailAddressesTable.php
@@ -59,6 +59,26 @@ class EmailAddressesTable extends Table {
     ]
   ];
   
+  /**
+   * Provide the default layout
+   *
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getLayout(): string {
+    return "iframe";
+  }
+  
+  /**
+   * Provide the default redirect goal
+   *
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getRedirectGoal(): string {
+    return "self";
+  }
+  
   /**
    * Perform Cake Model initialization.
    *
diff --git a/app/src/Model/Table/ExternalIdentitiesTable.php b/app/src/Model/Table/ExternalIdentitiesTable.php
index 1694fd076..986300d14 100644
--- a/app/src/Model/Table/ExternalIdentitiesTable.php
+++ b/app/src/Model/Table/ExternalIdentitiesTable.php
@@ -110,14 +110,15 @@ public function initialize(array $config): void {
 // XXX does some of this stuff really belong in the controller?
     $this->setEditContains([
       'PrimaryName',
-/*      'Addresses',
+      'Addresses',
       'AdHocAttributes',
       'EmailAddresses',
       'Identifiers',
       'Names',
-      'PersonRoles',
+      //'ExternalIdentityRoles',
+      'Pronouns',
       'TelephoneNumbers',
-      'Urls'*/
+      'Urls'
     ]);
     $this->setIndexContains(['PrimaryName']);
 
diff --git a/app/src/Model/Table/IdentifiersTable.php b/app/src/Model/Table/IdentifiersTable.php
index 899ebefc6..e89ae4a97 100644
--- a/app/src/Model/Table/IdentifiersTable.php
+++ b/app/src/Model/Table/IdentifiersTable.php
@@ -71,6 +71,26 @@ class IdentifiersTable extends Table {
     ]
   ];
   
+  /**
+   * Provide the default layout
+   *
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getLayout(): string {
+    return "iframe";
+  }
+  
+  /**
+   * Provide the default redirect goal
+   *
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getRedirectGoal(): string {
+    return "self";
+  }
+  
   /**
    * Perform Cake Model initialization.
    *
diff --git a/app/src/Model/Table/NamesTable.php b/app/src/Model/Table/NamesTable.php
index e748c622c..b0e5cace3 100644
--- a/app/src/Model/Table/NamesTable.php
+++ b/app/src/Model/Table/NamesTable.php
@@ -63,6 +63,26 @@ class NamesTable extends Table {
     ]
   ];
   
+  /**
+   * Provide the default layout
+   *
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getLayout(): string {
+    return "iframe";
+  }
+  
+  /**
+   * Provide the default redirect goal
+   *
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getRedirectGoal(): string {
+    return "self";
+  }
+    
   /**
    * Perform Cake Model initialization.
    *
diff --git a/app/src/Model/Table/PeopleTable.php b/app/src/Model/Table/PeopleTable.php
index b925f728b..2f52a217d 100644
--- a/app/src/Model/Table/PeopleTable.php
+++ b/app/src/Model/Table/PeopleTable.php
@@ -136,7 +136,8 @@ public function initialize(array $config): void {
       'EmailAddresses',
       'Identifiers',
       'Names',
-      'PersonRoles',
+      //'PersonRoles',
+      'Pronouns',
       'TelephoneNumbers',
       'Urls'
     ]);
diff --git a/app/src/Model/Table/PronounsTable.php b/app/src/Model/Table/PronounsTable.php
index 6f6fb511c..c1a74a567 100644
--- a/app/src/Model/Table/PronounsTable.php
+++ b/app/src/Model/Table/PronounsTable.php
@@ -54,6 +54,26 @@ class PronounsTable extends Table {
     ]
   ];
   
+  /**
+   * Provide the default layout
+   *
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getLayout(): string {
+    return "iframe";
+  }
+  
+  /**
+   * Provide the default redirect goal
+   *
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getRedirectGoal(): string {
+    return "self";
+  }
+  
   /**
    * Perform Cake Model initialization.
    *
diff --git a/app/src/Model/Table/TelephoneNumbersTable.php b/app/src/Model/Table/TelephoneNumbersTable.php
index ca8022826..0854d7ed2 100644
--- a/app/src/Model/Table/TelephoneNumbersTable.php
+++ b/app/src/Model/Table/TelephoneNumbersTable.php
@@ -58,6 +58,26 @@ class TelephoneNumbersTable extends Table {
     ]
   ];
   
+  /**
+   * Provide the default layout
+   *
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getLayout(): string {
+    return "iframe";
+  }
+  
+  /**
+   * Provide the default redirect goal
+   *
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getRedirectGoal(): string {
+    return "self";
+  }
+  
   /**
    * Perform Cake Model initialization.
    *
diff --git a/app/src/Model/Table/UrlsTable.php b/app/src/Model/Table/UrlsTable.php
index 1c446eca5..46f41c23f 100644
--- a/app/src/Model/Table/UrlsTable.php
+++ b/app/src/Model/Table/UrlsTable.php
@@ -54,6 +54,26 @@ class UrlsTable extends Table {
     ]
   ];
   
+  /**
+   * Provide the default layout
+   *
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getLayout(): string {
+    return "iframe";
+  }
+  
+  /**
+   * Provide the default redirect goal
+   *
+   * @since  COmanage Registry v5.0.0
+   * @return string  Type of redirect
+   */
+  public function getRedirectGoal(): string {
+    return "self";
+  }
+  
   /**
    * Perform Cake Model initialization.
    *
diff --git a/app/src/View/Helper/FieldHelper.php b/app/src/View/Helper/FieldHelper.php
index da303680d..437e17575 100644
--- a/app/src/View/Helper/FieldHelper.php
+++ b/app/src/View/Helper/FieldHelper.php
@@ -102,6 +102,17 @@ public function control(string $fieldName,
     
     // Specify a class on the <li> form control wrapper
     $liClass = $cssClass;
+  
+    // Get the field type from the map of fields (e.g. 'boolean', 'string', 'timestamp')
+    $fieldMap = $this->getView()->get('vv_field_types');
+    $fieldType = $fieldMap[$fieldName];
+    
+    // Collect any supplemental markup and/or JavaScript to pass along for field construction.
+    // Suppliment is an array: supplement['beforeField' => 'string', 'afterField' => 'string'].
+    $fieldSupplement = !empty($config['supplement']) ? $config['supplement'] : [];
+  
+    // For special fields that should not include <label> markup, allow fields to make the label text only
+    $labelIsTextOnly = !empty($config['labelIsTextOnly']) ? $config['labelIsTextOnly'] : false;
 
     // Remove prefix from field value
     if(isset($config['prefix'], $this->getView()->get('vv_obj')->$fieldName)) {
@@ -120,6 +131,13 @@ public function control(string $fieldName,
       // Note this will be ignored for non-select controls.
       $coptions['empty'] = true;
     }
+  
+    // A boolean field is a checkbox. Set the label and class to improve rendering
+    // and accessibility.
+    if($fieldType == 'boolean') {
+      $coptions['label'] = $labelText;
+      $coptions['class'] = 'form-check-input';
+    }
     
     // Generate the form control or pass along the markup generated in a wrapper function
     $controlCode = empty($ctrlCode) ? $this->Form->control($fieldName, $coptions) : $ctrlCode;
@@ -155,10 +173,10 @@ public function control(string $fieldName,
     }
     
     return $this->startLine($liClass)
-           . $this->formNameDiv($fieldName, $labelText)
+           . $this->formNameDiv($fieldName, $labelText, $fieldType, $labelIsTextOnly)
            . ( !empty($config['prefix']) ?
-                 $this->formInfoWithPrefixDiv($controlCode, $config['prefix']) :
-                 $this->formInfoDiv($controlCode) )
+                 $this->formInfoWithPrefixDiv($controlCode, $config['prefix'], $fieldSupplement) :
+                 $this->formInfoDiv($controlCode, $fieldSupplement) )
            . $this->endLine();
   }
   
@@ -274,33 +292,50 @@ protected function endLine(): string {
    * Generate a form info (control, value) box.
    *
    * @since  COmanage Registry v5.0.0
-   * @param  string  $content Content HTML
-   * @return string           Form Info HTML
+   * @param  string  $content    Content HTML
+   * @param  string  $supplement Supplemental markup to place before and/or after the field control 
+   * @return string              Form Info HTML
    */
   
-  protected function formInfoDiv(string $content): string {
-    return '<div class="field-info">
-      ' . $content . '
-    </div>';
+  protected function formInfoDiv(string $content, array $supplement): string {
+    $div  = '<div class="field-info">' . PHP_EOL;
+    if(!empty($supplement['beforeField'])) {
+      $div .= $supplement['beforeField'] . PHP_EOL;
+    }
+    $div .= $content . PHP_EOL;
+    if(!empty($supplement['afterField'])) {
+      $div .= $supplement['afterField'] . PHP_EOL;  
+    }
+    $div .= '</div>' . PHP_EOL;
+    
+    return $div;
   }
 
   /**
    * Generate a form info (control, value) box with a non editable prefix.
    *
    * @since  COmanage Registry v5.0.0
-   * @param  string  $content Content HTML
-   * @param  string  $prefix  Prefix value
-   * @return string           Form Info HTML
+   * @param  string  $content    Content HTML
+   * @param  string  $prefix     Prefix value
+   * @param  string  $supplement Supplemental markup to place before and/or after the field control
+   * @return string              Form Info HTML
    */
 
-  protected function formInfoWithPrefixDiv(string $context, string $prefix): string {
-    $div =  '<div class="field-info">' . PHP_EOL
-      . '<div class="input-group mb-3">' . PHP_EOL
-      . '<div class="input-group-prepend">' . PHP_EOL
-      . '<span class="input-group-text" id="basic-addon3">' . $prefix . '</span>'
-      . '</div>' . PHP_EOL
-      . $context
-      . '</div></div>';
+  protected function formInfoWithPrefixDiv(string $context, string $prefix, array $supplement): string {
+    $div  = '<div class="field-info">' . PHP_EOL;
+    if(!empty($supplement['beforeField'])) {
+      $div .= $supplement['beforeField'] . PHP_EOL;
+    }
+    $div .= '<div class="input-group mb-3">' . PHP_EOL;
+    $div .= '<div class="input-group-prepend">' . PHP_EOL;
+    $div .= '<span class="input-group-text" id="basic-addon3">' . $prefix . '</span>';
+    $div .= '</div>' . PHP_EOL;
+    $div .= $context;
+    $div .= '</div>';
+    if(!empty($supplement['afterField'])) {
+      $div .= $supplement['afterField'] . PHP_EOL;
+    }
+    $div .= '</div>';
 
     return $div;
   }
@@ -311,10 +346,12 @@ protected function formInfoWithPrefixDiv(string $context, string $prefix): strin
    * @since  COmanage Registry v5.0.0
    * @param  string  $fieldName Form field
    * @param  string  $labelText Label text (fieldName language key used by default)
+   * @param  string  $fieldType Type of field (string, boolean, timestamp, etc)
+   * @param  boolean $labelIsTextOnly True if label should be text only. Otherwise false.
    * @return string             Form Name HTML
    */
   
-  protected function formNameDiv(string $fieldName, string $labelText=null): string {
+  protected function formNameDiv(string $fieldName, string $labelText=null, string $fieldType, bool $labelIsTextOnly=false): string {
     $label = $labelText;
     $desc = null;
     
@@ -409,12 +446,13 @@ protected function formNameDiv(string $fieldName, string $labelText=null): strin
     
     return '<div class="field-name">
       <div class="field-title">'
-      . ($this->editable 
+      . (!($labelIsTextOnly) && ($fieldType != 'boolean')
          ? $this->Form->label($fn, $label)
          : $label) 
       . ($this->editable
            && in_array($fn, $this->reqFields)
-         ? ' <span class="required">*</span>' 
+         ? ' <span class="required" aria-hidden="true">*</span>'
+         . '<span class="visually-hidden">' . __d('field','required') . '</span>' 
          : '') . '
       </div>
       ' . ($desc ? '<span class="field-desc">' . $desc . '</span>' : "") .'
@@ -429,13 +467,15 @@ protected function formNameDiv(string $fieldName, string $labelText=null): strin
    * @param  string  $status    Status text
    * @param  array   $link      Link information, including 'url', 'label', 'class', 'confirm'
    * @param  string  $labelText Label text (fieldName language key used by default)
+   * @param  array   $config    Custom FormHelper configuration options
    * @return string
    */
   
   public function statusControl(string $fieldName, 
                                 string $status, 
                                 array $link=[], 
-                                string $labelText=null): string {
+                                string $labelText=null,
+                                array $config=[]): string {
     $linkHtml = $status;
     
     if($link) {
@@ -460,9 +500,12 @@ public function statusControl(string $fieldName,
         );
       }
     }
+  
+    // For special fields that should not include <label> markup, allow fields to make the label text only
+    $labelIsTextOnly = !empty($config['labelIsTextOnly']) ? $config['labelIsTextOnly'] : false;
      
     return $this->startLine()
-           . $this->formNameDiv($fieldName, $labelText)
+           . $this->formNameDiv($fieldName, $labelText, 'string', $labelIsTextOnly)
            . $linkHtml
            . $this->endLine();
   }
diff --git a/app/src/View/Helper/VueHelper.php b/app/src/View/Helper/VueHelper.php
index 7230ba524..37672e4f6 100644
--- a/app/src/View/Helper/VueHelper.php
+++ b/app/src/View/Helper/VueHelper.php
@@ -45,6 +45,9 @@ class VueHelper extends Helper {
     'information' => [
       'global.value.none',
       'datepicker.hour'
+    ],
+    'operation' => [
+      'close'
     ]
   ];
 
diff --git a/app/templates/ApiUsers/fields.inc b/app/templates/ApiUsers/fields.inc
index 80c0c0e00..065255c24 100644
--- a/app/templates/ApiUsers/fields.inc
+++ b/app/templates/ApiUsers/fields.inc
@@ -36,6 +36,7 @@ if($vv_action == 'add' || $vv_action == 'edit') {
   
   // We link to the "Generate" button on edit only
   $generateLink = [];
+  $config = [];
   
   if(!empty($vv_obj->id)) {
     $generateLink = [
@@ -45,14 +46,18 @@ if($vv_action == 'add' || $vv_action == 'edit') {
         $vv_obj->id
       ],
      'label' => __d('operation', 'api.key.generate'),
-     'class' => 'provisionbutton',
+     'class' => 'provisionbutton nospin',
      'confirm' => __d('operation', 'api.key.generate.confirm')
     ];
+    
+    $config = ['labelIsTextOnly' => true];
   }
   
   print $this->Field->statusControl('api_key',
                                     !empty($vv_obj->api_key) ? __d('enumeration', 'SetBooleanEnum.1') : __d('enumeration', 'SetBooleanEnum.0'),
-                                    $generateLink);
+                                    $generateLink,
+                                    null,
+                                    $config);
   
   print $this->Field->control('status', ['empty' => false]);
   
diff --git a/app/templates/ExternalIdentities/fields-nav.inc b/app/templates/ExternalIdentities/fields-nav.inc
index 6ffd1566c..745e3b332 100644
--- a/app/templates/ExternalIdentities/fields-nav.inc
+++ b/app/templates/ExternalIdentities/fields-nav.inc
@@ -25,6 +25,22 @@
  * @license       Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
  */
 
+// List the MVEAs that may be shown on the mveaCanvas
+// When this array exists, the mveaCanvas.php element will render  
+$mveas = [
+  'names',
+  'email_addresses',
+  'identifiers',
+  'ad_hoc_attributes',
+  'addresses',
+  'telephone_numbers',
+  'urls',
+  'pronouns'
+];
+
+// Name the MVEAs Entity Type
+$mveasEntityType = "external_identity";
+
 // XXX: if CFM-218 (Make fields.inc configuration only) is accepted, move the contents of this file into fields.inc
 $topLinks = [
   [
@@ -42,6 +58,60 @@ $topLinks = [
   ]
 ];
 
+// $addMenuLinks is also given slightly different treatment from the typical $topLinks found in most views: 
+// it is a page-global menu used for adding MVEAs and is given special treatment in element/mveaCanvas.php.
+$addMenuLinks = [
+  [
+    'controller' => 'names',
+    'action' => 'add',
+    'icon' => 'account_box',
+    'iconClass' => 'material-icons-outlined'
+  ],
+  [
+    'controller' => 'email_addresses',
+    'action' => 'add',
+    'icon' => 'email',
+    'iconClass' => 'material-icons-outlined'
+  ],
+  [
+    'controller' => 'identifiers',
+    'action' => 'add',
+    'icon' => 'fingerprint'
+  ],
+  [
+    'controller' => 'ad_hoc_attributes',
+    'action' => 'add',
+    'icon' => 'check_box',
+    'iconClass' => 'material-icons-outlined'
+  ],
+  [
+    'controller' => 'addresses',
+    'action' => 'add',
+    'icon' => 'contact_mail',
+    'iconClass' => 'material-icons-outlined'
+  ],
+  [
+    'controller' => 'history_records',
+    'action' => 'add',
+    'icon' => 'history'
+  ],
+  [
+    'controller' => 'pronouns',
+    'action' => 'add',
+    'icon' => 'transgender'
+  ],
+  [
+    'controller' => 'telephone_numbers',
+    'action' => 'add',
+    'icon' => 'phone'
+  ],
+  [
+    'controller' => 'urls',
+    'action' => 'add',
+    'icon' => 'link'
+  ]
+];
+
 $subnav = [
   'name' => 'person',
   'active' => 'external_identities',
diff --git a/app/templates/Jobs/fields-links.inc b/app/templates/Jobs/fields-nav.inc
similarity index 100%
rename from app/templates/Jobs/fields-links.inc
rename to app/templates/Jobs/fields-nav.inc
diff --git a/app/templates/Jobs/fields.inc b/app/templates/Jobs/fields.inc
index c646f41f8..71c3eee08 100644
--- a/app/templates/Jobs/fields.inc
+++ b/app/templates/Jobs/fields.inc
@@ -37,8 +37,37 @@ if($vv_action == 'view') {
       status: (string)$vv_obj->percent_complete
     );
   }
-
-  print $this->Field->control('parameters');
+  
+  $fieldSupplement = 
+    [
+      'beforeField' => '
+        <div class="field-suppliment">
+          <div class="form-check">
+            <input class="form-check-input" type="checkbox" value="" id="format-toggle">
+            <label class="form-check-label" for="format-toggle">' .
+              __d('field','format')
+            . '</label>
+          </div>
+        </div>
+      ',
+      'afterField' => '
+        <script>
+          parametersValue = $("#parameters").val();
+          parametersJSON = JSON.parse(parametersValue);
+          $("#format-toggle").click(function() {
+            if($(this).is(":checked")) {         
+              $("#parameters").val(JSON.stringify(parametersJSON, null, 4));
+              paramsHeight = Object.keys(parametersJSON).length + 6 + "em";
+              $("#parameters").css("height",paramsHeight);
+            } else {
+              $("#parameters").val(parametersValue);
+              $("#parameters").css("height","4em");
+            }
+          });
+        </script>
+      '
+    ];
+  print $this->Field->control('parameters', [], null, ['supplement' => $fieldSupplement]);
 
   print $this->Field->control('register_time');
 
diff --git a/app/templates/People/columns.inc b/app/templates/People/columns.inc
index e64a5f37b..c0c5b27e2 100644
--- a/app/templates/People/columns.inc
+++ b/app/templates/People/columns.inc
@@ -46,24 +46,6 @@ $topLinks = [];
 
 // $rowActions appear as row-level menu items in the index view gear icon
 $rowActions = [
-  [
-    'controller' => 'names',
-    'action' => 'index',
-    'icon' => 'account_box',
-    'iconClass' => 'material-icons-outlined'
-  ],
-  [
-    'controller' => 'email_addresses',
-    'action' => 'index',
-    'icon' => 'email',
-    'iconClass' => 'material-icons-outlined'
-  ],
-  [
-    'controller' => 'identifiers',
-    'action' => 'index',
-    'icon' => 'fingerprint',
-    'class' => 'bottom-border'
-  ],
   [
     'controller' => 'person_roles',
     'action' => 'index',
@@ -75,32 +57,10 @@ $rowActions = [
     'icon' => 'system_update_alt',
     'class' => 'bottom-border'
   ],
-  [
-    'controller' => 'ad_hoc_attributes',
-    'action' => 'index',
-    'icon' => 'check_box',
-    'iconClass' => 'material-icons-outlined'
-  ],
-  [
-    'controller' => 'addresses',
-    'action' => 'index',
-    'icon' => 'contact_mail',
-    'iconClass' => 'material-icons-outlined'
-  ],
   [
     'controller' => 'history_records',
     'action' => 'index',
     'icon' => 'history'
-  ],
-  [
-    'controller' => 'telephone_numbers',
-    'action' => 'index',
-    'icon' => 'phone'
-  ],
-  [
-    'controller' => 'urls',
-    'action' => 'index',
-    'icon' => 'link'
   ]
 ];
 
diff --git a/app/templates/People/fields-nav.inc b/app/templates/People/fields-nav.inc
index d35457602..e19d930a0 100644
--- a/app/templates/People/fields-nav.inc
+++ b/app/templates/People/fields-nav.inc
@@ -25,7 +25,23 @@
  * @license       Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
  */
 
-// XXX: if CFM-218 (Make fields.inc configuration only) is accepted, move the contents of this file into fields.inc
+// List the MVEAs that may be shown on the mveaCanvas
+// When this array exists, the mveaCanvas.php element will render  
+$mveas = [
+  'names',
+  'email_addresses',
+  'identifiers',
+  'ad_hoc_attributes',
+  'addresses',
+  'telephone_numbers',
+  'urls',
+  'pronouns'
+];
+
+// Name the MVEAs Entity Type
+$mveasEntityType = "person";  
+  
+// Output for $topLinks from this specific configuration is presented in the mveaCanvas.php "Actions" menu.   
 $topLinks = [
   [
     'icon' => 'history',
@@ -54,6 +70,60 @@ $topLinks = [
     'class' => ''
   ]
 ];
+  
+// $addMenuLinks is also given slightly different treatment from the typical $topLinks found in most views: 
+// it is a page-global menu used for adding MVEAs and is given special treatment in element/mveaCanvas.php.
+$addMenuLinks = [
+  [
+    'controller' => 'names',
+    'action' => 'add',
+    'icon' => 'account_box',
+    'iconClass' => 'material-icons-outlined'
+  ],
+  [
+    'controller' => 'email_addresses',
+    'action' => 'add',
+    'icon' => 'email',
+    'iconClass' => 'material-icons-outlined'
+  ],
+  [
+    'controller' => 'identifiers',
+    'action' => 'add',
+    'icon' => 'fingerprint'
+  ],
+  [
+    'controller' => 'ad_hoc_attributes',
+    'action' => 'add',
+    'icon' => 'check_box',
+    'iconClass' => 'material-icons-outlined'
+  ],
+  [
+    'controller' => 'addresses',
+    'action' => 'add',
+    'icon' => 'contact_mail',
+    'iconClass' => 'material-icons-outlined'
+  ],
+  [
+    'controller' => 'history_records',
+    'action' => 'add',
+    'icon' => 'history'
+  ],
+  [
+    'controller' => 'pronouns',
+    'action' => 'add',
+    'icon' => 'transgender'
+  ],
+  [
+    'controller' => 'telephone_numbers',
+    'action' => 'add',
+    'icon' => 'phone'
+  ],
+  [
+    'controller' => 'urls',
+    'action' => 'add',
+    'icon' => 'link'
+  ]
+];
 
 $subnav = [
   'name' => 'person',
diff --git a/app/templates/PersonRoles/fields-nav.inc b/app/templates/PersonRoles/fields-nav.inc
index e306f822c..454647d2d 100644
--- a/app/templates/PersonRoles/fields-nav.inc
+++ b/app/templates/PersonRoles/fields-nav.inc
@@ -25,9 +25,42 @@
  * @license       Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
  */
 
+// List the MVEAs that may be shown on the mveaCanvas
+// When this array exists, the mveaCanvas.php element will render  
+$mveas = [
+  'ad_hoc_attributes',
+  'addresses',
+  'telephone_numbers'
+];
+
+// Name the MVEAs Entity Type
+$mveasEntityType = "person_role";
+
 // XXX: if CFM-218 (Make fields.inc configuration only) is accepted, move the contents of this file into fields.inc
 $topLinks = [];
 
+// $addMenuLinks is also given slightly different treatment from the typical $topLinks found in most views: 
+// it is a page-global menu used for adding MVEAs and is given special treatment in element/mveaCanvas.php.
+$addMenuLinks = [
+  [
+    'controller' => 'ad_hoc_attributes',
+    'action' => 'add',
+    'icon' => 'check_box',
+    'iconClass' => 'material-icons-outlined'
+  ],
+  [
+    'controller' => 'addresses',
+    'action' => 'add',
+    'icon' => 'contact_mail',
+    'iconClass' => 'material-icons-outlined'
+  ],
+  [
+    'controller' => 'telephone_numbers',
+    'action' => 'add',
+    'icon' => 'phone'
+  ]
+];
+
 $subnav = [
   'name' => 'person',
   'active' => 'person_roles',
diff --git a/app/templates/Standard/add-edit-view.php b/app/templates/Standard/add-edit-view.php
index b4225a41d..5ae9d0abb 100644
--- a/app/templates/Standard/add-edit-view.php
+++ b/app/templates/Standard/add-edit-view.php
@@ -74,150 +74,92 @@
 if(!empty($subnav)) {
   // Include the $flashArgs for the subnavigation element
   $subnav['flashArgs'] = $flashArgs;
+  if(!empty($topLinks) && ($modelsName == 'People' &&  $vv_action == 'edit')) {
+    // We are in Person canvas mode: pass along the top links for building the Actions menu.
+    $subnav['topLinks'] = $topLinks;
+  }
   // Generate the subnavigation title and tabs
   print $this->element('subnavigation', $subnav);
 }
 ?>
 
-<?php /** Special case the Person "canvas" **/ ?>
-<?php if($modelsName == 'People' &&  $vv_action == 'edit'): ?>
+<div class="pageTitleContainer">
+  <div class="pageTitle">
+    <?php if(empty($subnav)): ?>
+      <h1><?= $vv_title; ?></h1>
+    <?php else: ?>
+      <h2><?= $vv_title; ?></h2>
+    <?php endif; ?>
+  </div>
   <?php
-  // Person Attributes to display.
-  $attributes = [
-    'names',
-    'email_addresses',
-    'identifiers',
-    'ad_hoc_attributes',
-    'addresses',
-    'telephone_numbers',
-    'urls',
-    'pronouns'
-  ];
-
-  // Count the number of widgets that will be displayed 
-  $widgetCount = 0;
-  foreach($attributes as $attr) {
-    if(!empty($vv_obj[$attr])) {
-      $widgetCount++;
-    }
-  }
+    // Action list for top menu dropdown / button listing
+    $action_args = array();
+    $action_args['vv_attr_id'] =  $vv_obj->id;
+    
+    foreach(($topLinks ?? []) as $t) {
+      $perm = false;
 
-  $objId = null;
-  if(!empty($vv_obj)) {
-    $objId = $vv_obj->id;
-  }
-  ?>
-  <div id="person-canvas" class="co-cards">
-    <!-- Person Attributes -->
-    <div id="person-canvas-attributes-js" class="row row-cols-1 g-4 <?= ($widgetCount > 1) ? 'row-cols-md-2' : ''?>">
-      <?php
-        foreach($attributes as $attr) {
-          if(!empty(($vv_obj[$attr]))) {
-            print $this->element(
-              'mveaJs',
-              [
-                'htmlId' => 'person-canvas-' . $attr . '-js',
-                'parentId' => $objId,
-                'mveaType' => $attr,
-                'entityType' => 'person'
-              ]
-            );
-          }
-        }
-        // XXX Add the DOB as its own special card.
-      ?>
-    </div>
-  </div>
-<?php else: /** normal output **/ ?>
-  <div class="pageTitleContainer">
-    <div class="pageTitle">
-      <?php if(empty($subnav)): ?>
-        <h1><?= $vv_title; ?></h1>
-      <?php else: ?>
-        <?php if(
-          // Subnavigation contains an h2 for these entities, so we need an h3
-          $vv_primary_link == 'person_role_id'
-          || $vv_primary_link == 'external_identity_id'
-          || $vv_primary_link == 'external_identity_role_id'
-          || $this->request->getParam('controller') == 'PersonRoles'
-          || $this->request->getParam('controller') == 'ExternalIdentities'
-          || $this->request->getParam('controller') == 'ExternalIdentityRoles'): ?>
-          <h3><?= $vv_title; ?></h3>
-        <?php else: ?>
-          <h2><?= $vv_title; ?></h2>
-        <?php endif; ?>
-      <?php endif; ?>
-    </div>
-    <?php
-      // Action list for top menu dropdown / button listing
-      $action_args = array();
-      $action_args['vv_attr_id'] =  $vv_obj->id;
-      
-      foreach(($topLinks ?? []) as $t) {
-        $perm = false;
-
-        if(!empty($t['link']['controller'])) {
-          // We're linking into a related model
-
-          $linkModel = \Cake\Utility\Inflector::camelize($t['link']['controller']);
-
-          if(isset($vv_permissions[$linkModel][ $t['link']['action'] ])) {
-            $perm = $vv_permissions[$linkModel][ $t['link']['action'] ];
-          }
-
-          // Inject a link to the current object ID
-          $t['link']['?'][\App\Lib\Util\StringUtilities::entityToForeignKey($vv_obj)] = $vv_obj->id;
-        } else {
-          $perm = $vv_permissions[ $t['link']['action'] ];
-
-          // We need to inject $linkFilter, but not overwrite any existing query params
-          if(!empty($t['link']['?'])) {
-            $t['link']['?'] = array_merge($t['link']['?'], $linkFilter);
-          } else {
-            $t['link']['?'] = $linkFilter;
-          }
+      if(!empty($t['link']['controller'])) {
+        // We're linking into a related model
+
+        $linkModel = \Cake\Utility\Inflector::camelize($t['link']['controller']);
+
+        if(isset($vv_permissions[$linkModel][ $t['link']['action'] ])) {
+          $perm = $vv_permissions[$linkModel][ $t['link']['action'] ];
         }
 
-        if($perm) {
-          $action_args['vv_actions'][] = [
-            'order' => $this->Menu->getMenuOrder($t['order']),
-            'icon' => $this->Menu->getMenuIcon($t['icon']),
-            'url' => $this->Url->build($t['link']),
-            'label' => $t['label'],
-          ];
+        // Inject a link to the current object ID
+        $t['link']['?'][\App\Lib\Util\StringUtilities::entityToForeignKey($vv_obj)] = $vv_obj->id;
+      } else {
+        $perm = $vv_permissions[ $t['link']['action'] ];
+
+        // We need to inject $linkFilter, but not overwrite any existing query params
+        if(!empty($t['link']['?'])) {
+          $t['link']['?'] = array_merge($t['link']['?'], $linkFilter);
+        } else {
+          $t['link']['?'] = $linkFilter;
         }
       }
-    
-      // Delete
-      if($vv_action != 'add' && !empty($vv_obj->id) && $vv_permissions['delete']) {
-        $actionPostBtnArray = ['action' => 'delete', $vv_obj->id];
-        $actionUrl = $this->Url->build(['action' => 'delete', $vv_obj->id]);
-        $action_args['vv_actions'][] = array(
-          'order' => $this->Menu->getMenuOrder('Delete'),
-          'icon' =>  $this->Menu->getMenuIcon('Delete'),
-          'url' => 'javascript:void(0);',
-          'label' => __d('operation', 'delete'),
-          'class' => 'deletebutton nospin',
-          'onclick' => array(
-            'dg_bd_txt' => __d('operation', 'delete.confirm', [$vv_obj->id]),
-            'dg_post_btn_array' => $actionPostBtnArray,
-            'dg_url' => $actionUrl,
-            'dg_conf_btn' => __d('operation', 'remove'),
-            'dg_cancel_btn' => __d('operation', 'cancel'),
-            'dg_title' => __d('operation', 'remove'),
-            'dg_bd_txt_repl_str' => ''
-          )
-        );
-      }
-    
-      if(!empty($action_args['vv_actions'])) {
-        print '<div class="field-actions top-links">';
-        print $this->element('menuAction', $action_args);
-        print '</div>';
+
+      if($perm) {
+        $action_args['vv_actions'][] = [
+          'order' => $this->Menu->getMenuOrder($t['order']),
+          'icon' => $this->Menu->getMenuIcon($t['icon']),
+          'url' => $this->Url->build($t['link']),
+          'label' => $t['label'],
+        ];
       }
-    ?>
-  </div>
-<?php endif; /** end Person "canvas" vs. normal output **/?>
+    }
+  
+    // Delete
+    if($vv_action != 'add' && !empty($vv_obj->id) && $vv_permissions['delete']) {
+      $actionPostBtnArray = ['action' => 'delete', $vv_obj->id];
+      $actionUrl = $this->Url->build(['action' => 'delete', $vv_obj->id]);
+      $action_args['vv_actions'][] = array(
+        'order' => $this->Menu->getMenuOrder('Delete'),
+        'icon' =>  $this->Menu->getMenuIcon('Delete'),
+        'url' => 'javascript:void(0);',
+        'label' => __d('operation', 'delete'),
+        'class' => 'deletebutton nospin',
+        'onclick' => array(
+          'dg_bd_txt' => __d('operation', 'delete.confirm', [$vv_obj->id]),
+          'dg_post_btn_array' => $actionPostBtnArray,
+          'dg_url' => $actionUrl,
+          'dg_conf_btn' => __d('operation', 'remove'),
+          'dg_cancel_btn' => __d('operation', 'cancel'),
+          'dg_title' => __d('operation', 'remove'),
+          'dg_bd_txt_repl_str' => ''
+        )
+      );
+    }
+  
+    if(!empty($action_args['vv_actions'])) {
+      print '<div class="field-actions top-links">';
+      print $this->element('menuAction', $action_args);
+      print '</div>';
+    }
+  ?>
+</div>
 
 <?php if(empty($subnav)): ?>
   <?php /* Flash Messages are placed below the main title when there's no subnavigation. */ ?>
@@ -288,4 +230,15 @@
 
 print $this->Field->endControlSet();
 
+/** MVEA Canvas output **/
+if($vv_action != 'add' && !empty($mveas)) {
+  // Pass along the $mveas and any $addMenuLinks defined in templates/.../fields-nav.inc config. 
+  print $this->element('mveaCanvas',
+    [
+      'vv_mveas' => $mveas,
+      'vv_add_menu_links' => !empty($addMenuLinks) ? $addMenuLinks : '',
+      'vv_entity_type' => $mveasEntityType
+    ]);
+}  
+
 // XXX insert changelog metadata (+nav? or maybe we should have a dedicate index view that shows all records in revision order?)
diff --git a/app/templates/Standard/index.php b/app/templates/Standard/index.php
index 6a0030ac1..ab58c950b 100644
--- a/app/templates/Standard/index.php
+++ b/app/templates/Standard/index.php
@@ -87,15 +87,7 @@
     <?php if(empty($subnav)): ?>
       <h1><?= $vv_title; ?></h1>
     <?php else: ?>
-      <?php if(
-        // Subnavigation contains an h2 for these entities, so we need an h3
-        $vv_primary_link == 'person_role_id'
-        || $vv_primary_link == 'external_identity_id'
-        || $vv_primary_link == 'external_identity_role_id'): ?>
-        <h3><?= $vv_title; ?></h3>
-      <?php else: ?>
-        <h2><?= $vv_title; ?></h2>
-      <?php endif; ?>
+      <h2><?= $vv_title; ?></h2>
     <?php endif; ?>
   </div>
 
diff --git a/app/templates/element/filter.php b/app/templates/element/filter.php
index ff1805d40..a37a5ab81 100644
--- a/app/templates/element/filter.php
+++ b/app/templates/element/filter.php
@@ -90,7 +90,7 @@
 <div id="<?= $modelName . ucfirst($this->request->getParam('action')); ?>Search" class="top-filters">
   <fieldset>
     <legend id="top-filters-toggle">
-      <em class="material-icons">search</em>
+      <em class="material-icons" aria-hidden="true">search</em>
       <?= __d('operation', 'filter'); ?>
 
       <?php if(!empty($search_params)):?>
@@ -115,7 +115,7 @@
               (is_array($search_params[$key]) ? 'Range' : $search_params[$key]);
           ?>
           <button class="top-filters-active-filter deletebutton spin btn btn-default btn-sm" data-identifier="<?= $data_identifier ?>" type="button" aria-controls="<?php print $aria_controls; ?>" title="<?= __d('operation', 'clear.filters',[2]); ?>">
-             <em class="material-icons">cancel</em>
+             <em class="material-icons" aria-hidden="true">cancel</em>
              <span class="top-filters-active-filter-title">
                <?= $vv_searchable_attributes[$key]['label'] ?>
              </span>
diff --git a/app/templates/element/javascript.php b/app/templates/element/javascript.php
index acfdf8f7f..0933962e4 100644
--- a/app/templates/element/javascript.php
+++ b/app/templates/element/javascript.php
@@ -158,7 +158,8 @@
     $("select").not("#limit").not(".duet-date__select--month").not(".duet-date__select--year").select2({
       width: '100%',
       tags: true,
-      placeholder: "-- Select --"
+      placeholder: "-- Select --",
+      allowClear: true
     });
 
     // Generic row click handling
@@ -203,6 +204,17 @@
         });
       }
     });
+    
+    // Person canvas "Add" links
+    // Launch the MVEA modal window, load the Add url, and refresh the appropriate component when done.
+    $('#mvea-add-menu-container ul a').click(function(e) {
+      e.preventDefault();
+      e.stopPropagation();
+      var title = $(this).find('.action-link-text').text();
+      var url = $(this).prop('href');
+      var componentRef = 'mvea' + $(this).data('cm-mveatype');
+      window.cmMveaModal.launch(title,url,componentRef);
+    });
 
     // Bulk edit switch
     $('#bulk-edit-switch').click(function() {
diff --git a/app/templates/element/menuAction.php b/app/templates/element/menuAction.php
index ee4549b6d..b6d79a04a 100644
--- a/app/templates/element/menuAction.php
+++ b/app/templates/element/menuAction.php
@@ -47,7 +47,7 @@ class="<?= $actionsMenuClass; ?>">
     'title' => __d('field', 'action')
   );
   print $this->Html->link(
-    '<span class="material-icons">' . $actionsIcon . '</span> ' . $actionsTitle,
+    '<span class="material-icons" aria-hidden="true">' . $actionsIcon . '</span> ' . $actionsTitle,
     'javascript:void(0);',
     $linkparams
   );
@@ -61,18 +61,26 @@ class="<?= $actionsMenuClass; ?>">
   ?>
   <ul id="action-list_<?= $actionsMenuUid; ?>" class="dropdown-menu nospin">
     <?php foreach($vv_actions as $action): ?>
+      <?php 
+        $actionDataAttrs = '';
+        if(!empty($action['dataAttrs'])) {
+          foreach($action['dataAttrs'] as $dataAttr) {
+            $actionDataAttrs = ' ' . $dataAttr[0] . '="' . $dataAttr[1] . '"';
+          }
+        } 
+      ?>
       <li class="action-list-item">
         <?php $actionCssClass = (!empty($action['class'])) ? "dropdown-item " . $action['class'] : "dropdown-item"; ?>
         <?php if(empty($action['onclick'])): ?>
-          <a class="<?= $actionCssClass; ?>" href="<?= $action['url']; ?>">
+          <a class="<?= $actionCssClass; ?>" href="<?= $action['url']; ?>"<?= !(empty($actionDataAttrs)) ? $actionDataAttrs : '' ?>>
             <?php if(!empty($action['icon'])): ?>
               <?php if(!empty($action['iconClass'])): ?>
-                <em class="<?= $action['iconClass']; ?>"><?= $action['icon']; ?></em>
+                <em class="<?= $action['iconClass']; ?>" aria-hidden="true"><?= $action['icon']; ?></em>
               <?php else: ?>
-                <em class="material-icons"><?= $action['icon']; ?></em>
+                <em class="material-icons" aria-hidden="true"><?= $action['icon']; ?></em>
               <?php endif; ?>
             <?php endif; ?>
-            <?= $action['label']; ?>
+            <span class="action-link-text"><?= $action['label']; ?></span>
           </a>
         <?php else: ?>
           <?php
@@ -94,7 +102,7 @@ class="<?= $actionsMenuClass; ?>">
               <?php if(!empty($action['icon_class'])): ?>
                 <em class="<?= $action['icon_class']; ?>"><?= $action['icon']; ?></em>
               <?php else: ?>
-                <em class="material-icons"><?= $action['icon']; ?></em>
+                <em class="material-icons" aria-hidden="true"><?= $action['icon']; ?></em>
               <?php endif; ?>
             <?php endif; ?>
             <?= $action['label']; ?>
diff --git a/app/templates/element/menuMain.php b/app/templates/element/menuMain.php
index db18e2c74..6b77a62a2 100644
--- a/app/templates/element/menuMain.php
+++ b/app/templates/element/menuMain.php
@@ -102,7 +102,7 @@
     </ul>
   </nav>
   <button id="co-menu-collapse">
-    <em class="material-icons-outlined co-menu-collapse-icon">
+    <em class="material-icons-outlined co-menu-collapse-icon" aria-hidden="true">
       expand_circle_down
     </em>
     <div class="co-menu-collapse-text">close</div>
diff --git a/app/templates/element/menuPanel.php b/app/templates/element/menuPanel.php
index 43681f4a7..ccee4e789 100644
--- a/app/templates/element/menuPanel.php
+++ b/app/templates/element/menuPanel.php
@@ -43,7 +43,7 @@
           );
           ?>
           <a href="<?= $menuUrl ?>" class="menu-panel-primary-link">
-            <div class="material-icons-outlined">person</div>
+            <div class="material-icons-outlined" aria-hidden="true">person</div>
             <div class="menu-panel-primary-link-text">
               <h3><?= __d('menu','co.people.population') ?></h3>
               <div class="menu-panel-link-desc"><?= __d('menu','co.people.population.desc') ?></div>
@@ -64,7 +64,7 @@
             );
           ?>
           <a href="<?= $menuUrl ?>" class="menu-panel-primary-link">
-            <div class="material-icons-outlined">pending_actions</div>
+            <div class="material-icons-outlined" aria-hidden="true">pending_actions</div>
             <div class="menu-panel-primary-link-text">
               <h3><?= __d('menu','co.people.enrollments.pending') ?></h3>
               <div class="menu-panel-link-desc"><?= __d('menu','co.people.enrollments.pending.desc') ?></div>
@@ -115,7 +115,7 @@
             );
           ?>
           <a href="<?= $menuUrl ?>" class="menu-panel-primary-link">
-            <div class="material-icons-outlined">groups</div>
+            <div class="material-icons-outlined" aria-hidden="true">groups</div>
             <div class="menu-panel-primary-link-text">
               <h3><?= __d('controller', 'Cous', [99]) ?></h3>
               <div class="menu-panel-link-desc"><?= __d('menu','co.structure.cous.desc') ?></div>
@@ -134,7 +134,7 @@
             );
           ?>
           <a href="<?= $menuUrl ?>" class="menu-panel-primary-link">
-            <div class="material-icons-outlined">people_outline</div>
+            <div class="material-icons-outlined" aria-hidden="true">people_outline</div>
             <div class="menu-panel-primary-link-text">
               <h3><?= __d('controller', 'Groups', [99]) ?></h3>
               <div class="menu-panel-link-desc"><?= __d('menu','co.structure.groups.desc') ?></div>
@@ -199,7 +199,7 @@
             );
           ?>
           <a href="<?= $menuUrl ?>" class="menu-panel-primary-link">
-            <div class="material-icons-outlined">assignment</div>
+            <div class="material-icons-outlined" aria-hidden="true">assignment</div>
             <div class="menu-panel-primary-link-text">
               <h3><?= __d('controller', 'Jobs', [99]) ?></h3>
               <div class="menu-panel-link-desc"><?= __d('menu','co.operations.jobs.desc') ?></div>
@@ -217,7 +217,7 @@
             );
           ?>
           <a href="<?= $menuUrl ?>" class="menu-panel-primary-link">
-            <div class="material-icons-outlined">summarize</div>
+            <div class="material-icons-outlined" aria-hidden="true">summarize</div>
             <div class="menu-panel-primary-link-text">
               <h3><?= __d('controller', 'Reports', [99]) ?></h3>
               <div class="menu-panel-link-desc"><?= __d('menu','co.operations.reports.desc') ?></div>
diff --git a/app/templates/element/menuTop.php b/app/templates/element/menuTop.php
index ae31fd56c..980a9368e 100644
--- a/app/templates/element/menuTop.php
+++ b/app/templates/element/menuTop.php
@@ -29,11 +29,17 @@
 <?php if(!empty($vv_user)): ?>
   <ul>
     <li id="top-menu-user">
-      <button type="button" class="dropdown-toggle top-menu-button" id="user-panel-toggle" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+      <button type="button" 
+              class="dropdown-toggle top-menu-button" 
+              id="user-panel-toggle" 
+              data-bs-toggle="dropdown" 
+              aria-haspopup="true" 
+              aria-expanded="false"
+              aria-label="<?= __d('menu','menu.user') ?>">
         <span class="top-menu-link-text">
           <?= $vv_user['username']; ?>
         </span>
-        <em class="material-icons icon-adjust">person</em>
+        <em class="material-icons icon-adjust" aria-hidden="true">person</em>
       </button>
       <?php 
         // If you're debugging $vv_available_cos being null, you probably forgot
@@ -51,7 +57,7 @@
           ?>
         </div>
         <div id="user-panel-user-info">
-          <em class="material-icons">person</em>
+          <em class="material-icons" aria-hidden="true">person</em>
           <div id="user-panel-cn"><?= $vv_user['username']; ?></div>
           <div id="user-panel-id"><!-- XXX identifier goes here --></div>
         </div>
@@ -61,11 +67,11 @@
             Settings
           </a>
           <ul class="dropdown-menu">
-            <li><a class="dropdown-item" href="#"><span class="material-icons">dark_mode</span> Dark mode</a></li>
+            <li><a class="dropdown-item" href="#"><span class="material-icons" aria-hidden="true">dark_mode</span> Dark mode</a></li>
             <li><hr class="dropdown-divider"></li>
-            <li><a class="dropdown-item" href="#"><span class="material-icons">density_small</span>Density small</a></li>
-            <li><a class="dropdown-item" href="#"><span class="material-icons">density_medium</span>Density medium</a></li>
-            <li><a class="dropdown-item" href="#"><span class="material-icons">density_large</span>Density large</a></li>
+            <li><a class="dropdown-item" href="#"><span class="material-icons" aria-hidden="true">density_small</span>Density small</a></li>
+            <li><a class="dropdown-item" href="#"><span class="material-icons" aria-hidden="true">density_medium</span>Density medium</a></li>
+            <li><a class="dropdown-item" href="#"><span class="material-icons" aria-hidden="true">density_large</span>Density large</a></li>
           </ul>
         </div>
         <?php if(count($vv_available_cos) > 1): // More than one CO is available, so present the switch button ?>
@@ -92,7 +98,7 @@
                                'action'     => 'select',
                                'plugin'     => false],
                               ['escape'     => false,
-                               'id'         => 'login',
+                               'id'         => 'login-button',
                                'class'      => 'btn btn-small']);
     }
   ?>
diff --git a/app/templates/element/mveaCanvas.php b/app/templates/element/mveaCanvas.php
new file mode 100644
index 000000000..ea76f0b0f
--- /dev/null
+++ b/app/templates/element/mveaCanvas.php
@@ -0,0 +1,115 @@
+<?php
+  /**
+   * COmanage Registry MVEA Canvas Element
+   *
+   * Portions licensed to the University Corporation for Advanced Internet
+   * Development, Inc. ("UCAID") under one or more contributor license agreements.
+   * See the NOTICE file distributed with this work for additional information
+   * regarding copyright ownership.
+   *
+   * UCAID licenses this file to you under the Apache License, Version 2.0
+   * (the "License"); you may not use this file except in compliance with the
+   * License. You may obtain a copy of the License at:
+   *
+   * http://www.apache.org/licenses/LICENSE-2.0
+   *
+   * Unless required by applicable law or agreed to in writing, software
+   * distributed under the License is distributed on an "AS IS" BASIS,
+   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   * See the License for the specific language governing permissions and
+   * limitations under the License.
+   *
+   * @link          https://www.internet2.edu/comanage COmanage Project
+   * @package       registry
+   * @since         COmanage Registry v5.0.0
+   * @license       Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
+   */
+  
+  // Get the object ID
+  $objId = null;
+  if(!empty($vv_obj)) {
+    $objId = $vv_obj->id;
+  }
+  
+  // Build the Add menu
+  if(!empty($vv_add_menu_links)) {
+    $action_args = array();
+    $action_args['vv_attr_id'] = $objId;
+    $action_args['vv_actions_type'] = 'mvea-add-menu';
+    $action_args['vv_actions_title'] = __d('operation', 'add');
+    $action_args['vv_actions_icon'] = 'add_circle';
+    $action_args['vv_actions_class'] = 'mvea-add-menu';
+    $actionOrderDefault = $this->Menu->getMenuOrder('Default');
+    $addMenuActions = $vv_add_menu_links;
+    foreach (($addMenuActions ?? []) as $a) {
+      $actionOrder = !empty($a['order']) ? $a['order'] : $actionOrderDefault++;
+      $actionIcon = !empty($a['icon']) ? $a['icon'] : $this->Menu->getMenuIcon('Default');
+      $actionIconClass = !empty($a['iconClass']) ? $a['iconClass'] : '';
+      $actionClass = !empty($a['class']) ? $a['class'] . ' nospin' : 'nospin';
+      $actionUrl = $this->Url->build(
+        [
+          'controller' => $a['controller'],
+          'action' => $a['action'],
+          '?' => [
+            $vv_entity_type . '_id' => $objId
+          ]
+        ]
+      );
+      $actionLabel = __d('controller', Cake\Utility\Inflector::camelize($a['controller']), [1]);
+      $actionDataAttrs = [['data-cm-mveatype', $a['controller']]];
+      $action_args['vv_actions'][] = [
+        'order' => $actionOrder,
+        'icon' => $actionIcon,
+        'iconClass' => $actionIconClass,
+        'url' => $actionUrl,
+        'class' => $actionClass,
+        'label' => $actionLabel,
+        'dataAttrs' => $actionDataAttrs
+      ];
+    }
+  }
+?>
+<div id="mvea-canvas-title-container">
+  <h2><?= __d('information','global.attributes') ?></h2>
+  <?php if(!empty($vv_add_menu_links)): ?>
+    <div id="mvea-add-menu-container" class="field-actions">
+      <?= $this->element('menuAction', $action_args) ?>
+    </div>
+  <?php endif; ?>
+</div>
+
+
+<?php
+  // Construct the canvas using JavaScript components.
+  // Attributes to display.
+  $attributes = $vv_mveas;
+  
+  // Count the number of widgets that will be displayed 
+  $widgetCount = 0;
+  foreach($attributes as $attr) {
+    if(!empty($vv_obj[$attr])) {
+      $widgetCount++;
+    }
+  }
+?>
+<div id="mvea-canvas" class="co-cards">
+  <div id="mvea-canvas-attributes-js" class="row row-cols-1 g-4 <?= ($widgetCount > 1) ? 'row-cols-md-2' : ''?>">
+    <?php
+      foreach($attributes as $attr) {
+        if(!empty(($vv_obj[$attr]))) {
+          print $this->element(
+            'mveaJs',
+            [
+              'htmlId' => 'mvea-canvas-' . $attr . '-js',
+              'parentId' => $objId,
+              'mveaType' => $attr,
+              'entityType' => $vv_entity_type
+            ]
+          );
+        }
+      }
+      // TODO: Add the DOB as its own special card (CFM-261)
+      print $this->element('mveaModal');
+    ?>
+  </div>
+</div>
\ No newline at end of file
diff --git a/app/templates/element/mveaJs.php b/app/templates/element/mveaJs.php
index aa404dae2..9518b6498 100644
--- a/app/templates/element/mveaJs.php
+++ b/app/templates/element/mveaJs.php
@@ -47,8 +47,10 @@
 <script type="module">
   <?php if(Cake\Core\Configure::read('debug')): ?>
     import Mveas from "<?= $this->Url->script('comanage/components/mvea/mveas.js') ?>?time=<?= time() ?>";
+    import MveaModal from "<?= $this->Url->script('comanage/components/mvea/mvea-modal.js') ?>?time=<?= time() ?>";
   <?php else: ?>
     import Mveas from "<?= $this->Url->script('comanage/components/mvea/mveas.js') ?>";
+    import MveaModal from "<?= $this->Url->script('comanage/components/mvea/mvea-modal.js') ?>";
   <?php endif; ?>
   
   const app = Vue.createApp({
@@ -60,6 +62,7 @@
           parentId: '<?= $parentId ?>',
           mveaType: '<?= $mveaType ?>',
           mveaController: '<?= Cake\Utility\Inflector::dasherize($mveaController) ?>',
+          mveaTitle: '<?= $title ?>',
           webroot: '<?= $this->request->getAttribute('webroot') ?>'
         },
         txt: JSON.parse('<?= json_encode($vueHelper->locales()) ?>'),
@@ -100,19 +103,26 @@
         this.successTxt = '';
         if(xhr.statusText != undefined && xhr.statusText != '') {
           this.setError(xhr.statusText)
-          console.log('Status Code:', xhr.status)
+          console.log('Status Code: ', xhr.status)
         } else {
           console.error(xhr);
           this.setError(this.txt.error500);
         }
+      },
+      launchModal(title,url,componentRef) {
+        window.cmMveaModal.launch(title,url,componentRef);
+      },
+      refreshComponent() {
+        this.getMveas('<?= $mveaType ?>', '<?= $entityType ?>');
       }
     },
     created() {
-      this.getMveas('<?= $mveaType ?>', '<?= $entityType ?>');
+      this.refreshComponent();
     }
   });
 
-  app.mount("#<?= $htmlId ?>");
+  // Mount the component and provide a global reference for this app instance.
+  window.mvea<?= $mveaType ?> = app.mount("#<?= $htmlId ?>");
 </script>
 
 <div id="<?= $htmlId ?>" class="col cm-mvea-col">
diff --git a/app/templates/element/mveaModal.php b/app/templates/element/mveaModal.php
new file mode 100644
index 000000000..d9f2f2740
--- /dev/null
+++ b/app/templates/element/mveaModal.php
@@ -0,0 +1,112 @@
+<?php
+/**
+ * COmanage Registry MVEA Vue.js Modal Component
+ *
+ * Portions licensed to the University Corporation for Advanced Internet
+ * Development, Inc. ("UCAID") under one or more contributor license agreements.
+ * See the NOTICE file distributed with this work for additional information
+ * regarding copyright ownership.
+ *
+ * UCAID licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with the
+ * License. You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * @link          https://www.internet2.edu/comanage COmanage Project
+ * @package       registry
+ * @since         COmanage Registry v5.0.0
+ * @license       Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
+ */
+
+// Get the CSRF Token in JavaScript  
+$token = $this->request->getAttribute('csrfToken');
+// Load my helper functions
+$vueHelper = $this->loadHelper('Vue');
+
+
+// Create a modal for handling MVEA adds/edits via iframe. XXX We may rename to a generic modal at some point.
+?>
+
+<script type="module">
+  <?php if(Cake\Core\Configure::read('debug')): ?>
+    import MveaModal from "<?= $this->Url->script('comanage/components/mvea/mvea-modal.js') ?>?time=<?= time() ?>";
+  <?php else: ?>
+    import MveaModal from "<?= $this->Url->script('comanage/components/mvea/mvea-modal.js') ?>";
+  <?php endif; ?>
+  
+  const mveaModalApp = Vue.createApp({
+    data() {
+      return {
+        componentRef: null,
+        mveaModal: null,
+        modalElement: null,
+        core: {
+          webroot: '<?= $this->request->getAttribute('webroot') ?>'
+        },
+        isLoading: true,
+        modal: {
+          title: '<?= __d('information','global.attribute.modal') ?>',
+          url: ''
+        },
+        txt: JSON.parse('<?= json_encode($vueHelper->locales()) ?>')
+      }
+    },
+    components: {
+      MveaModal
+    },
+    methods: {
+      launch(title, url, componentRef) {
+        this.modal.title = title;
+        this.modal.url = url;
+        this.componentRef = componentRef;
+        this.mveaModal.show(); // this is a call to Bootstrap dialog set up in mounted()
+      },
+      refreshMveaComponent() {
+        // Get a reference to the MVEA component we're updating
+        const ref = window[this.componentRef];
+        if (typeof (ref) === "undefined") {
+          // The component doesn't exist, so reload the page to construct the new 
+          // MVEA component on the canvas
+          location.reload();
+        } else {
+          // refresh the existing component via ajax
+          ref.refreshComponent();
+        }
+        // Clear the modal after a refresh
+        this.modal.title = '';
+        this.modal.url = '';
+      },
+      hide() {
+        // Can be called from inner iframe with window.parent.cmMveaModal.hide()
+        this.mveaModal.hide();
+      }
+    },
+    mounted() {
+      this.modalElement = document.getElementById('mvea-modal');
+      this.mveaModal = new bootstrap.Modal(this.modalElement);
+      var thisComponent = this;
+      // When the modal is hidden, refresh the relevant component
+      this.modalElement.addEventListener('hide.bs.modal', function (e) {
+        thisComponent.refreshMveaComponent();
+      })
+    }
+  });
+  
+  // Mount the component and provide a global reference for this app instance.
+  window.cmMveaModal = mveaModalApp.mount("#mvea-modal-container");
+</script>
+
+<div id="mvea-modal-container">
+  <mvea-modal
+    :modal="this.modal"
+    :core="this.core"
+    :txt="this.txt">
+  </mvea-modal>
+</div>
diff --git a/app/templates/element/searchGlobal.php b/app/templates/element/searchGlobal.php
index cfbfff0e1..faf8a3d17 100644
--- a/app/templates/element/searchGlobal.php
+++ b/app/templates/element/searchGlobal.php
@@ -38,11 +38,11 @@
 ?>
 
 <button id="global-search-toggle" class="dropdown-toggle top-menu-button" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
-  <em class="material-icons">search</em>
+  <em class="material-icons" aria-hidden="true">search</em>
   <span class="visually-hidden"><?= __d('operation','search') ?></span>
 </button>
 
-<div id="global-search" class="dropdown-menu" aria-labelledby="global-search-toggle">
+<div id="global-search" class="dropdown-menu">
   <?php
     print $this->Form->create(null, $options);
     print $this->Form->hidden('co_id', ['default' => $vv_cur_co->id]);
@@ -64,7 +64,7 @@
       ]
     );
     print $this->Form->button(
-      '<span class="material-icons">close</span>',
+      '<span class="material-icons" aria-hidden="true">close</span>',
       [
         'type' => 'button', 
         'escapeTitle' => false, 
@@ -74,7 +74,7 @@
       ]
     );
     print $this->Form->button(
-      '<em class="material-icons">search</em>',
+      '<em class="material-icons" aria-hidden="true">search</em>',
       [
         'type' => 'submit', 
         'escapeTitle' => false, 
diff --git a/app/templates/element/subnavigation.php b/app/templates/element/subnavigation.php
index 4f20daa68..29663eac3 100644
--- a/app/templates/element/subnavigation.php
+++ b/app/templates/element/subnavigation.php
@@ -95,98 +95,10 @@
       <?php endif; ?>
     </div>
     
+    <?php /* XXX Turn off the global actions menu but leave it here for now. We may restore it for a different purpose later.
     <?php if($name == 'person'): ?>
-      <!-- Specialty person dropdown menus - ADD and global actions -->
+      <!-- Specialty person dropdown menus - global actions -->
       <nav id="person-actions">
-        <?php
-          // Build the Add menu
-          $action_args = array();
-          $action_args['vv_attr_id'] =  $curId;
-          $action_args['vv_actions_type'] = 'person-actions-add-menu';
-          $action_args['vv_actions_title'] = __d('operation','add');
-          $action_args['vv_actions_icon'] = 'add_circle';
-          $action_args['vv_actions_class'] = 'person-actions-add-menu';
-          $actionOrderDefault = $this->Menu->getMenuOrder('Default');
-          $personAddMenuActions = [
-            [
-              'controller' => 'names',
-              'action' => 'add',
-              'icon' => 'account_box',
-              'iconClass' => 'material-icons-outlined'
-            ],
-            [
-              'controller' => 'email_addresses',
-              'action' => 'add',
-              'icon' => 'email',
-              'iconClass' => 'material-icons-outlined'
-            ],
-            [
-              'controller' => 'identifiers',
-              'action' => 'add',
-              'icon' => 'fingerprint'
-            ],
-            [
-              'controller' => 'person_roles',
-              'action' => 'add',
-              'icon' => 'emoji_people'
-            ],
-            [
-              'controller' => 'ad_hoc_attributes',
-              'action' => 'add',
-              'icon' => 'check_box',
-              'iconClass' => 'material-icons-outlined'
-            ],
-            [
-              'controller' => 'addresses',
-              'action' => 'add',
-              'icon' => 'contact_mail',
-              'iconClass' => 'material-icons-outlined'
-            ],
-            [
-              'controller' => 'history_records',
-              'action' => 'add',
-              'icon' => 'history'
-            ],
-            [
-              'controller' => 'telephone_numbers',
-              'action' => 'add',
-              'icon' => 'phone'
-            ],
-            [
-              'controller' => 'urls',
-              'action' => 'add',
-              'icon' => 'link'
-            ]
-          ];
-          foreach(($personAddMenuActions ?? []) as $a) {
-            $actionOrder = !empty($a['order']) ? $a['order'] : $actionOrderDefault++;
-            $actionIcon = !empty($a['icon']) ? $a['icon'] : $this->Menu->getMenuIcon('Default');
-            $actionIconClass = !empty($a['iconClass']) ? $a['iconClass'] : '';
-            $actionClass = !empty($a['class']) ? $a['class'] : '';
-            $actionUrl = $this->Url->build(
-              [
-                'controller' => $a['controller'],
-                'action' => $a['action'],
-                '?' => [
-                  'person_id' => $curId
-                ]
-              ]
-            );
-            $actionLabel = __d('controller', Cake\Utility\Inflector::camelize($a['controller']), [1]);
-            $action_args['vv_actions'][] = [
-              'order' => $actionOrder,
-              'icon' => $actionIcon,
-              'iconClass' => $actionIconClass,
-              'url' => $actionUrl,
-              'class' => $actionClass,
-              'label' => $actionLabel
-            ];
-          }
-        ?>
-        <div class="field-actions person-actions-add-menu-container">
-          <?= $this->element('menuAction', $action_args) ?>
-        </div>
-            
         <?php
           // Build the global Person Actions menu
           $action_args = array();
@@ -195,38 +107,16 @@
           $action_args['vv_actions_title'] = __d('field','actions',[99]);
           $action_args['vv_actions_icon'] = 'settings';
           $action_args['vv_actions_class'] = 'person-actions-menu';
-          // history records
-          $actionUrl = $this->Url->build(
-            [
-              'controller' => 'history_records',
-              'action' => 'index',
-              '?' => [
-                'person_id' => $curId
-              ]
-            ]
-          );
-          $action_args['vv_actions'][] = array(
-            'order' => $this->Menu->getMenuOrder('Default'),
-            'icon' => 'history',
-            'url' => $actionUrl,
-            'label' => __d('controller', 'HistoryRecords', [99])
-          );
-          // provisioning actions
-          $actionUrl = $this->Url->build(
-            [
-              'controller' => 'provisioning_targets',
-              'action' => 'status',
-              '?' => [
-                'person_id' => $curId
-              ]
-            ]
-          );
-          $action_args['vv_actions'][] = array(
-            'order' => $this->Menu->getMenuOrder('Default'),
-            'icon' => 'cloud_sync',
-            'url' => $actionUrl,
-            'label' => __d('operation', 'provisioning.status')
-          );
+          if(!empty($topLinks)) {
+            foreach ($topLinks as $action) {
+              $action_args['vv_actions'][] = array(
+                'order' => $this->Menu->getMenuOrder($action['order']),
+                'icon' => $action['icon'],
+                'url' => $this->Url->build($action['link']),
+                'label' => $action['label']
+              );
+            }
+          }
           // delete
           $actionPostBtnArray = ['action' => 'delete', $curId];
           $actionUrl = $this->Url->build(['action' => 'delete', $curId]);
@@ -256,6 +146,7 @@
         </div>
       </nav>
     <?php endif; // person-actions ?>
+      */ ?>
   </div>
 
   <?php /* Flash Messages are placed below supertitle when subnavigation exists. */ ?>
@@ -425,51 +316,21 @@
       <?php endif; // group ?>
     </ul>
   </nav>
-    
-  <?php if(!empty($subActive) && !($curController == 'PersonRoles' && $curAction == 'add')): ?>
-  <!-- Second Level Subnavigation Links -->
+
+  <?php if(!empty($subActive) && $isExternalId): ?>
+    <!-- Second Level Subnavigation Links -->
     <?php
       $parentId = $curId;
       $curId = $this->request->getQuery($vv_primary_link);
-      if($isPersonRole || $isExternalId) {
-        if($isExternalId && !empty($vv_ei_id)) {
-          $curId = $vv_ei_id;
-        }
-        // We display the role or external identity name above the subnav to show the hierarchy.
-        // We also use this structure to set the second-level $linkFilter
-        print '<h2>';
-        if(!empty($vv_ei_name)) {
-          // We have an external identity name
-          print $vv_ei_name->full_name;
-          $linkFilter = ['external_identity_id' => $curId];
-        } elseif(!empty($vv_person_role)) {
-          // We have a person role
-          print $vv_person_role;
-          $linkFilter = ['person_role_id' => $curId];
-        } elseif(!empty($vv_obj)) {
-          // We are editing/viewing an object
-          if(!empty($vv_obj->title)) {
-            print $vv_obj->title;
-          } elseif (!empty($vv_subtitle)) {
-            print $vv_subtitle;
-          } else {
-            print print __d('information','global.title.none');
-          }
-          // Set up $linkFilter for edit/view on Roles and External Identities
-          $curId = $vv_obj->id;
-          if($curController == 'PersonRoles') {
-            $linkFilter = ['person_role_id' => $curId];
-          }
-          if($curController == 'ExternalIdentities') {
-            $linkFilter = ['external_identity_id' => $curId];
-          }
-        } else {
-          // We shouldn't get here, but have a deafult in case.
-          print __d('information','global.title.none');
-        }
-        print '</h2>'; 
-      }
+      if(!empty($vv_ei_id)) {
+        $curId = $vv_ei_id;
+        $linkFilter = ['external_identity_id' => $curId];
+      } elseif(!empty($vv_obj)) {
+        $curId = $vv_obj->id;
+        $linkFilter = ['external_identity_id' => $curId];
+      } 
     ?>
+    <?php if($isExternalId): ?>
     <nav id="cm-<?= $name ?>-subnav-links" class="cm-subnav-links">
       <ul class="list-inline">
         <?php if($name == 'person'): ?>
@@ -502,101 +363,13 @@
               );
             ?>
           </li>
-          <?php if(!$isPersonRole): ?>
-            <li class="list-inline-item">
-              <?php
-                // Names
-                $linkClass = ($subActive == 'names') ? 'nav-link active' : 'nav-link';
-                print $this->Html->link(
-                  __d('controller', 'Names', [99]),
-                  [ 'controller' => 'names',
-                    'action' => 'index',
-                    '?' => $linkFilter
-                  ],
-                  ['class' => $linkClass]
-                );
-              ?>
-            </li>
-            <li class="list-inline-item">
-              <?php
-                // Email Addresses
-                $linkClass = ($subActive == 'email_addresses') ? 'nav-link active' : 'nav-link';
-                print $this->Html->link(
-                  __d('controller', 'EmailAddresses', [99]),
-                  [ 'controller' => 'email_addresses',
-                    'action' => 'index',
-                    '?' => $linkFilter
-                  ],
-                  ['class' => $linkClass]
-                );
-              ?>  
-            </li>
-            <li class="list-inline-item">
-              <?php
-                // Identifiers
-                $linkClass = ($subActive == 'identifiers') ? 'nav-link active' : 'nav-link';
-                print $this->Html->link(
-                  __d('controller', 'Identifiers', [99]),
-                  [ 'controller' => 'identifiers',
-                    'action' => 'index',
-                    '?' => $linkFilter
-                  ],
-                  ['class' => $linkClass]
-                );
-              ?>
-            </li>
-            <?php if($isExternalId): ?>
-              <li class="list-inline-item">
-                <?php
-                  // External Identity Roles
-                  $linkClass = ($subActive == 'external_identity_roles' ||  $isExternalIdRole) ? 'nav-link active' : 'nav-link';
-                  print $this->Html->link(
-                    __d('controller', 'ExternalIdentityRoles', [99]),
-                    [ 'controller' => 'external_identity_roles',
-                      'action' => 'index',
-                      '?' => $linkFilter
-                    ],
-                    ['class' => $linkClass]
-                  );
-                ?>
-              </li>
-            <?php endif; ?>
-          <?php endif; ?>
-          <li class="list-inline-item">
-            <?php
-              // Ad-Hoc Attributes
-              $linkClass = ($subActive == 'ad_hoc_attributes' && !($isExternalIdRole)) ? 'nav-link active' : 'nav-link';
-              print $this->Html->link(
-                __d('controller', 'AdHocAttributes', [99]),
-                [ 'controller' => 'ad_hoc_attributes',
-                  'action' => 'index',
-                  '?' => $linkFilter
-                ],
-                ['class' => $linkClass]
-              );
-            ?>
-          </li>
-          <li class="list-inline-item">
-            <?php
-              // Addresses
-              $linkClass = ($subActive == 'addresses' && !($isExternalIdRole)) ? 'nav-link active' : 'nav-link';
-              print $this->Html->link(
-                __d('controller', 'Addresses', [99]),
-                [ 'controller' => 'addresses',
-                  'action' => 'index',
-                  '?' => $linkFilter
-                ],
-                ['class' => $linkClass]
-              );
-            ?>
-          </li>
           <li class="list-inline-item">
             <?php
-              // Telephone Numbers
-              $linkClass = ($subActive == 'telephone_numbers' && !($isExternalIdRole)) ? 'nav-link active' : 'nav-link';
+              // External Identity Roles
+              $linkClass = ($subActive == 'external_identity_roles' ||  $isExternalIdRole) ? 'nav-link active' : 'nav-link';
               print $this->Html->link(
-                __d('controller', 'TelephoneNumbers', [99]),
-                [ 'controller' => 'telephone_numbers',
+                __d('controller', 'ExternalIdentityRoles', [99]),
+                [ 'controller' => 'external_identity_roles',
                   'action' => 'index',
                   '?' => $linkFilter
                 ],
@@ -604,35 +377,6 @@
               );
             ?>
           </li>
-          <?php if(!$isPersonRole): ?>
-            <li class="list-inline-item">
-              <?php
-                // URLs
-                $linkClass = ($subActive == 'urls') ? 'nav-link active' : 'nav-link';
-                print $this->Html->link(
-                  __d('controller', 'Urls', [99]),
-                  [ 'controller' => 'urls',
-                    'action' => 'index',
-                    '?' => $linkFilter
-                  ],
-                  ['class' => $linkClass]
-                );
-              ?>
-            </li>
-            <li class="list-inline-item">
-              <?php
-                // Pronouns
-                $linkClass = ($subActive == 'pronouns') ? 'nav-link active' : 'nav-link';
-                print $this->Html->link(
-                  __d('controller', 'Pronouns', [99]),
-                  [ 'controller' => 'pronouns',
-                    'action' => 'index',
-                    '?' => $linkFilter
-                  ],
-                  ['class' => $linkClass]
-                );
-              ?>
-            </li>
           <?php endif; ?>
         <?php endif; // person subnav ?>
       </ul>
@@ -724,7 +468,7 @@
           </ul>  
         </nav>
       </div>
-    <?php endif; // external identity 2nd level subnav ?>
-  <?php endif; // 2nd level subnav ?>
+    <?php endif; // end $isExternalIdRole ?>
+  <?php endif; // end  $isExternalId ?>
 </div>
   
\ No newline at end of file
diff --git a/app/templates/layout/iframe.php b/app/templates/layout/iframe.php
new file mode 100644
index 000000000..13aae2d7b
--- /dev/null
+++ b/app/templates/layout/iframe.php
@@ -0,0 +1,151 @@
+<?php
+/**
+ * COmanage Registry Iframe Content Layout
+ *
+ * Portions licensed to the University Corporation for Advanced Internet
+ * Development, Inc. ("UCAID") under one or more contributor license agreements.
+ * See the NOTICE file distributed with this work for additional information
+ * regarding copyright ownership.
+ *
+ * UCAID licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with the
+ * License. You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * @link          https://www.internet2.edu/comanage COmanage Project
+ * @package       registry
+ * @since         COmanage Registry v5.0.0
+ * @license       Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
+ */
+
+declare(strict_types = 1);
+
+// As a general rule, all Registry pages are post-login and so shouldn't be cached
+header("Expires: Thursday, 10-Jan-69 00:00:00 GMT");
+header("Cache-Control: no-store, no-cache, max-age=0, must-revalidate");
+header("Pragma: no-cache");
+
+// Add X-UA-Compatible header for IE
+if(isset($_SERVER['HTTP_USER_AGENT']) && (strpos($_SERVER['HTTP_USER_AGENT'], 'MSIE') !== false)) {
+  header('X-UA-Compatible: IE=edge,chrome=1');
+}
+?>
+<!DOCTYPE html>
+<html lang="<?= __('registry.meta.lang'); ?>">
+  <head>
+    <?= $this->Html->meta('viewport', 'width=device-width, initial-scale=1.0') . PHP_EOL ?>
+    <?= $this->Html->charset(); ?>
+
+    <title><?= (!empty($vv_title) ? $vv_title : __('registry.meta.registry')); ?></title>
+    <!-- <?php
+      // Include version number, but only if logged in
+      if(!empty($vv_user)) {
+        print __('registry.meta.version', [chop(file_get_contents(CONFIG . DS . "VERSION"))]);
+      }
+    ?> -->
+
+    <!-- favicon.ico -->
+    <?= $this->Html->meta('favicon.ico', '/favicon.ico', array('type' => 'icon')) . PHP_EOL ?>
+
+    <!-- Load CSS -->
+    <?= $this->Html->css([
+      'bootstrap/bootstrap.min',
+      'select2/select2.min',
+      'co-color',
+      'co-base',
+      'co-responsive'
+    ]) . PHP_EOL ?>
+
+    <!-- Load Bootstrap and jQuery (other scripts at bottom) -->
+    <?= $this->Html->script([
+      'bootstrap/bootstrap.bundle.min.js',
+      'jquery/jquery.min.js',
+      'select2/select2.min.js'
+    ]) . PHP_EOL ?>
+
+    <!-- Include external files and scripts -->
+    <?= $this->fetch('meta') ?>
+    <?= $this->fetch('css') ?>
+    <?= $this->fetch('script') ?>
+  </head>
+
+  <?php
+    // cleanse the controller and action strings and insert them into the body classes
+    $controller_stripped = preg_replace('/[^a-zA-Z0-9\-_]/', '', strtolower($this->request->getParam('controller')));
+    $action_stripped = preg_replace('/[^a-zA-Z0-9\-_]/', '', strtolower($this->request->getParam('action')));
+    $bodyClasses = $controller_stripped . ' ' . $action_stripped . ' in-iframe';
+    $isCoSelectView = $controller_stripped == 'cos' && $action_stripped == 'select';
+    $isDashboard = $controller_stripped == 'dashboards' && $action_stripped == 'dashboard';
+
+    // add further body classes as needed
+    if(!empty($vv_user)) {
+      $bodyClasses .= ' logged-in';
+    } else {
+      $bodyClasses .= ' logged-out';
+    }
+  ?>
+  <body class="<?= $bodyClasses ?>" onload="js_onload_call_hooks()">
+    <!-- Iframe layout -->
+    <div id="comanage-iframe-wrapper">
+      <main id="main">
+        <div id="content">
+          <!-- insert the page internal content -->
+          <?= $this->fetch('content') ?>
+        </div>
+      </main>
+    </div>
+
+    <!-- loading animation -->
+    <div id="co-loading"><span></span><span></span><span></span></div>
+
+    <!-- modal dialog box -->
+    <?= $this->element('dialog') ?>
+
+    <!-- Get timezone detection -->
+    <?= $this->Html->script('jstimezonedetect/jstz.min.js') ?>
+    <script>
+      // Determines the time zone of the browser client
+      var tz = jstz.determine();
+      // This won't be available for the first delivered page, but after that the
+      // server side should see it and process it
+      document.cookie = "cm_registry_tz_auto=" + tz.name() + "; path=/";
+    </script>
+
+    <!-- Load Javascript -->
+    <!-- XXX js-cookie should be deprecated -->
+    <?= $this->Html->script([      
+      'vue/vue-3.2.31.global.prod.js',
+      'js-cookie/js.cookie-2.1.3.min.js',
+      'comanage/comanage.js'
+    ]) . PHP_EOL ?>
+
+    <!-- Duet Datepicker should be loaded as a module -->
+    <?= $this->Html->script('duet-datepicker/duet/duet.esm.js',['type' => 'module']) ?>
+    <?= $this->Html->script('duet-datepicker/duet/duet.js',['nomodule' => '']) ?>
+
+    <!-- COmanage JavaScript onload scripts -->
+    <?php print $this->element('javascript'); ?>
+  
+    <!-- COmanage iframe-specific JavaScript -->
+    <script>
+      $(document).keyup(function(e) {
+        if (e.key === "Escape") {
+          // If we're in a modal, dismiss it when the escape key is pressed
+          if(window.parent === top 
+            && typeof window.parent.cmMveaModal !== 'undefined'
+            && typeof window.parent.cmMveaModal.hide === 'function') {
+            window.parent.cmMveaModal.hide();
+          }
+        }
+      });
+    </script>
+
+  </body>
+</html>
diff --git a/app/webroot/css/co-base.css b/app/webroot/css/co-base.css
index a2354152c..ab88eef49 100644
--- a/app/webroot/css/co-base.css
+++ b/app/webroot/css/co-base.css
@@ -50,7 +50,7 @@ h1.loginMsg {
 }
 h2 {
   font-size: 2em;
-  line-height: 2.5em;
+  line-height: 2em;
   margin: 0;
 }
 h3 {
@@ -331,7 +331,7 @@ body.cos.select #top-bar {
   margin: 0 0 0.25rem;
 }
 /* LOGIN & LOGOUT */
-#login {
+#login-button {
   display: inline-block;
   padding: 0.25em 1em;
   text-decoration: none;
@@ -628,6 +628,12 @@ ul.form-list li.alert-banner .co-alert {
 #subnavigation nav {
   padding: 0.5em 0;
 }
+#cm-person-subnav-tabs {
+  margin-bottom: 1.5em;
+}
+#cm-person-subnav-links {
+  margin-top: -2em;
+}
 .cm-subnav-tabs .nav-link {
   text-transform: uppercase;
   padding: 1em 1.5em;
@@ -1022,18 +1028,31 @@ table.index-table .form-check {
 #person-actions .action-menu-toggle {
   white-space: nowrap;
 }
-#person-canvas-attributes,
-#person-canvas-attributes-js {
+#mvea-add-menu-container {
+  float: right;
+  margin: 1em 0 0;
+}
+#mvea-canvas {
+  clear: both;
+}
+#mvea-canvas-title-container {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  margin: 3em 0 -0.5em;
+}
+#mvea-canvas-attributes,
+#mvea-canvas-attributes-js {
   margin-top: 0;
   margin-bottom: 2em;
 }
-#person-canvas-attributes-js .badge {
+#mvea-canvas-attributes-js .badge {
   margin-right: 0.5em;
 }
-#person-canvas-attributes-js .canvas-url-link {
+#mvea-canvas-attributes-js .canvas-url-link {
   margin-left: 1em;
 }
-#person-canvas-roles {
+#mvea-canvas-roles {
   margin-bottom: 2em;
 }
 h2.card-title {
@@ -1175,19 +1194,11 @@ ul.form-list li.field-stack textarea {
   width: 100%;
   resize: vertical;
 }
-.checkbox {
-  margin-bottom: 0.5em;
-}
-.checkbox input {
-  float: left;
-  margin: 4px 4px 0 0;
-}
-.checkbox label {
-  margin-left: 1.5em;
-  display: block;
+ul.form-list .field-suppliment {
+  font-size: 0.9em;
 }
-.checkbox label::first-line {
-  margin-left: 0;
+.checkbox label input {
+  margin-right: 0.5em;
 }
 .checkbox .subfield {
   margin-left: 1.5em;
@@ -1340,6 +1351,36 @@ ul.form-list .cm-time-picker-vals li {
 #dialog .modal-footer {
   border-top: none;
 }
+/* MVEA MODAL */
+.mvea-modal .modal-dialog {
+  max-width: 90vw;
+}
+.mvea-modal .modal-header {
+  padding: 0.5rem 1rem;
+  background-color: var(--cmg-color-lightgray-004);
+  border-bottom: none;
+}
+.mvea-modal .modal-content {
+  height: 80vh;
+}
+.mvea-modal .modal-body {
+  padding-top: 0;
+}
+.mvea-modal iframe {
+  width: 100%;
+  height: 100%;
+}
+#comanage-iframe-wrapper #subnavigation .supertitle-container,
+#comanage-iframe-wrapper #subnavigation #cm-person-subnav-tabs,
+#comanage-iframe-wrapper #subnavigation #cm-person-subnav-links {
+  display: none;  
+}
+#comanage-iframe-wrapper #content {
+  padding: 1rem 2em 0;
+}
+#comanage-iframe-wrapper .pageTitleContainer {
+  margin: 1em 0;
+}
 /* GENERAL */
 .hidden,
 .invisible,
diff --git a/app/webroot/css/co-responsive.css b/app/webroot/css/co-responsive.css
index b957c7f89..14cfa1c5a 100644
--- a/app/webroot/css/co-responsive.css
+++ b/app/webroot/css/co-responsive.css
@@ -52,7 +52,7 @@
   }
   h2 {
     font-size: 2em;
-    line-height: 2em;
+    line-height: 1.2em;
   }
   #logout {
     display: block;
@@ -105,7 +105,7 @@
     grid-template-columns: 1fr 1fr;
     align-items: center;
   }
-  #person-canvas-roles .field-data-container {
+  #mvea-canvas-roles .field-data-container {
     grid-template-columns: 1fr 1fr 2fr auto;
   }
   /* PAGINATION */
diff --git a/app/webroot/js/comanage/components/mvea/mvea-item.js b/app/webroot/js/comanage/components/mvea/mvea-item.js
index 7a1df06d5..611a5aa04 100644
--- a/app/webroot/js/comanage/components/mvea/mvea-item.js
+++ b/app/webroot/js/comanage/components/mvea/mvea-item.js
@@ -36,7 +36,6 @@ export default {
   },
   computed: {
     mveaLink: function() {
-      // For now, link to the underlying PHP form. We will change this behavior as we develop the JS forms.
       return this.core.webroot + this.core.mveaController + '/edit/' + this.mvea.id;
     }
   },
@@ -45,7 +44,11 @@ export default {
       return constructLanguageString(lang)
     },
     followRowLink() {
-      location.href = this.mveaLink;
+      //location.href = this.mveaLink;
+      this.$nextTick(() => {
+        var componentReference = 'mvea' + this.core.mveaType;
+        this.$parent.$parent.launchModal(this.core.mveaTitle, this.mveaLink, componentReference);
+      });
     }
   },
   mounted() {
@@ -55,7 +58,7 @@ export default {
     <!-- Names -->
     <li class="field-data-container linked-row" v-if="this.core.mveaType == 'names'" @click="followRowLink">
       <div class="field-data force-wrap">
-        <a :href="mveaLink" class="row-link">
+        <a :href="mveaLink" class="row-link" @click.prevent>
           <!-- If there is a display name use it. Otherwise, check language and produce right-to-left 
             order or left-to-right order. This approach is similar to Model/Entity/Name.php::_getFullName(). 
             XXX We expect to get the full_name out of the API, so remove this logic when we have the full name. 
@@ -81,7 +84,7 @@ export default {
     <!-- Email Addresses -->
     <li class="field-data-container linked-row" v-if="this.core.mveaType == 'email_addresses'" @click="followRowLink">
       <div class="field-data force-wrap">
-        <a :href="mveaLink" class="row-link">{{ this.mvea.mail }}</a>                                              
+        <a :href="mveaLink" class="row-link" @click.prevent>{{ this.mvea.mail }}</a>                                              
       </div>
       <div class="field-data data-label">
         <span v-if="!(this.mvea.verified)" class="mr-1 badge bg-warning unverified">{{ this.txt.unverified }}</span>
@@ -91,7 +94,7 @@ export default {
     <!-- Identifiers -->
     <li class="field-data-container linked-row" v-if="this.core.mveaType == 'identifiers'" @click="followRowLink">
       <div class="field-data force-wrap">
-        <a :href="mveaLink" class="nospin">{{ this.mvea.identifier }}</a>                                              
+        <a :href="mveaLink" class="row-link" @click.prevent>{{ this.mvea.identifier }}</a>                                              
       </div>
       <div class="field-data data-label">
         <span v-if="this.mvea.login" class="mr-1 badge bg-outline-secondary login">{{ this.txt.login }}</span>
@@ -101,7 +104,7 @@ export default {
     <!-- Ad Hoc Attributes -->
     <li class="field-data-container linked-row" v-if="this.core.mveaType == 'ad_hoc_attributes'" @click="followRowLink">
       <div class="field-data force-wrap">
-        <a :href="mveaLink" class="row-link">{{ this.mvea.value != '' ? this.mvea.value : this.txt["global.value.none"] }}</a>
+        <a :href="mveaLink" class="row-link" @click.prevent>{{ this.mvea.value != '' ? this.mvea.value : this.txt["global.value.none"] }}</a>
       </div>
       <div v-if="this.mvea.tag != ''" class="field-data data-label">
         <span class="mr-1 badge bg-light ad-hoc">{{ this.mvea.tag }}</span>
@@ -111,7 +114,7 @@ export default {
     <li class="field-data-container linked-row" v-if="this.core.mveaType == 'addresses'" @click="followRowLink">
       <div class="field-data force-wrap">
         <address>
-          <a :href="mveaLink" class="row-link">{{ this.mvea.room }} {{ this.mvea.street }}</a>
+          <a :href="mveaLink" class="row-link" @click.prevent>{{ this.mvea.room }} {{ this.mvea.street }}</a>
           <span v-if="this.mvea.locality != '' || this.mvea.state != ''" class="addr-locality-state">
             <br>{{ this.mvea.locality }}{{ this.mvea.locality != '' && this.mvea.state != '' ? ', ' : ''}}{{ this.mvea.state }}
           </span>
@@ -127,7 +130,7 @@ export default {
     <!-- Telephone Numbers -->
     <li class="field-data-container linked-row" v-if="this.core.mveaType == 'telephone_numbers'" @click="followRowLink">
       <div class="field-data force-wrap">
-        <a :href="mveaLink" class="row-link">{{ this.mvea.country_code }} {{ this.mvea.area_code }} {{ this.mvea.number }}</a>                                              
+        <a :href="mveaLink" class="row-link" @click.prevent>{{ this.mvea.country_code }} {{ this.mvea.area_code }} {{ this.mvea.number }}</a>                                              
       </div>
       <div class="field-data data-label">
         <span class="mr-1 badge bg-light">{{ this.mvea.type.display_name }}</span>
@@ -136,7 +139,7 @@ export default {
     <!-- Urls -->
     <li class="field-data-container linked-row" v-if="this.core.mveaType == 'urls'" @click="followRowLink">
       <div class="field-data force-wrap">
-        <a :href="mveaLink" class="row-link">{{ this.mvea.description != '' ? this.mvea.description : this.mvea.url }}</a>   
+        <a :href="mveaLink" class="row-link" @click.prevent>{{ this.mvea.description != '' ? this.mvea.description : this.mvea.url }}</a>   
         <a :href="this.mvea.url" class="canvas-url-link" :title="this.txt['global.visit.link']"><span class="material-icons">north_east</span></a>
       </div>
       <div class="field-data data-label">
@@ -146,7 +149,7 @@ export default {
     <!-- Pronouns -->
     <li class="field-data-container linked-row" v-if="this.core.mveaType == 'pronouns'" @click="followRowLink">
       <div class="field-data force-wrap">
-        <a :href="mveaLink" class="row-link">{{ this.mvea.type_id }}</a>                                              
+        <a :href="mveaLink" class="row-link" @click.prevent>{{ this.mvea.type_id }}</a>                                              
       </div>
       <div class="field-data data-label">
         <span class="mr-1 badge bg-light">{{ this.mvea.type.display_name }}</span>
diff --git a/app/webroot/js/comanage/components/mvea/mvea-modal.js b/app/webroot/js/comanage/components/mvea/mvea-modal.js
new file mode 100644
index 000000000..0977d3ae2
--- /dev/null
+++ b/app/webroot/js/comanage/components/mvea/mvea-modal.js
@@ -0,0 +1,49 @@
+/**
+ * COmanage Registry MVEA Modal JavaScript
+ *
+ * Portions licensed to the University Corporation for Advanced Internet
+ * Development, Inc. ("UCAID") under one or more contributor license agreements.
+ * See the NOTICE file distributed with this work for additional information
+ * regarding copyright ownership.
+ *
+ * UCAID licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with the
+ * License. You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * @link          https://www.internet2.edu/comanage COmanage Project
+ * @package       registry
+ * @since         COmanage Registry v5.0.0
+ * @license       Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
+ */
+
+export default {
+  props: {
+    modal: Object,
+    core: Object,
+    txt: Object
+  },
+  template: `
+    <div className="modal fade mvea-modal" id="mvea-modal" aria-labelledby="mvea-modal-title" tabIndex="-1" aria-hidden="true">
+      <div className="modal-dialog modal-dialog-centered">
+        <div className="modal-content">
+          <div className="modal-header">
+            <h2 class="modal-title" id="mvea-modal-title">{{ this.modal.title }}</h2>
+            <button type="button" className="btn-close nospin" data-bs-dismiss="modal"
+                    :aria-label="txt.close"></button>
+          </div>
+          <div id="mvea-modal-text" className="modal-body">
+            <iframe :src="this.modal.url"/>
+          </div>
+        </div>
+      </div>
+    </div>
+  `
+}
\ No newline at end of file
diff --git a/app/webroot/js/comanage/components/mvea/mveas.js b/app/webroot/js/comanage/components/mvea/mveas.js
index 2b98a5292..bd3a7bfa0 100644
--- a/app/webroot/js/comanage/components/mvea/mveas.js
+++ b/app/webroot/js/comanage/components/mvea/mveas.js
@@ -48,6 +48,11 @@ export default {
       return this.mveas?.[camelize(this.core.mveaType)]
     }
   },
+  methods: {
+    refresh() {
+      this.$parent.refreshComponent();
+    }
+  },
   template: `
     <ul class="cm-mvea fields data-list">
       <mvea-item 
diff --git a/container/build.sh b/container/build.sh
new file mode 100755
index 000000000..2c24ec49a
--- /dev/null
+++ b/container/build.sh
@@ -0,0 +1,713 @@
+#!/bin/bash
+#
+# Build containers for COmanage Registry and associated tools.
+#
+# Portions licensed to the University Corporation for Advanced Internet
+# Development, Inc. ("UCAID") under one or more contributor license agreements.
+# See the NOTICE file distributed with this work for additional information
+# regarding copyright ownership.
+#
+# UCAID licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+###########################################################################
+# Build the Registry base image.
+# Globals:
+#   None
+# Arguments:
+#   Full image name prefix, a string.
+#   Tag label, a string.
+#   Tag suffix, a string.
+#   Docker build flags, other flags for docker build.
+# Outputs:
+#   None
+###########################################################################
+function build_base() {
+    local docker_build_command
+    local docker_build_flags
+    local label
+    local prefix
+    local suffix
+
+    prefix="$1"
+    label="$2"
+    suffix="$3"
+
+    if [[ -z "${label}" ]]; then
+        err "ERROR:build_base: label cannot be empty"
+        return 1
+    fi
+
+    if [[ -z "${suffix}" ]]; then
+        err "ERROR:build_base: suffix cannot be empty"
+        return 1
+    fi
+
+    declare -a docker_build_flags=("${@:4}")
+
+    tag="comanage-registry-base:${label}-${suffix}"
+
+    docker_build_command=(docker build)
+
+    if ((${#docker_build_flags[@]})); then
+        for flag in "${docker_build_flags[@]}"; do
+            docker_build_command+=("${flag}")
+        done
+    fi
+
+    docker_build_command+=(--tag "${tag}")
+    docker_build_command+=(--build-arg COMANAGE_REGISTRY_VERSION="${label}")
+    docker_build_command+=(--file container/registry/base/Dockerfile)
+    docker_build_command+=(.)
+
+    "${docker_build_command[@]}"
+
+    if (( $? != 0 )); then
+        exit 1
+    fi
+
+    if [[ -n "${prefix}" ]]; then
+        target="${prefix}${tag}"
+        docker tag "${tag}" "${target}"
+    fi
+}
+
+###########################################################################
+# Build the Registry basic auth image.
+# Globals:
+#   None
+# Arguments:
+#   Full image name prefix, a string.
+#   Tag label, a string.
+#   Tag suffix, a string.
+#   Docker build flags, other flags for docker build.
+# Outputs:
+#   None
+###########################################################################
+function build_basic_auth() {
+    local docker_build_command
+    local docker_build_flags
+    local label
+    local prefix
+    local suffix
+
+    prefix="$1"
+    label="$2"
+    suffix="$3"
+
+    if [[ -z "${label}" ]]; then
+        err "ERROR:build_basic_auth: label cannot be empty"
+        return 1
+    fi
+
+    if [[ -z "${suffix}" ]]; then
+        err "ERROR:build_basic_auth: suffix cannot be empty"
+        return 1
+    fi
+
+    declare -a docker_build_flags=("${@:4}")
+
+    tag="comanage-registry:${label}-basic-auth-${suffix}"
+
+    docker_build_command=(docker build)
+
+    if ((${#docker_build_flags[@]})); then
+        for flag in "${docker_build_flags[@]}"; do
+            docker_build_command+=("${flag}")
+        done
+    fi
+
+    docker_build_command+=(--tag "${tag}")
+    docker_build_command+=(--build-arg COMANAGE_REGISTRY_VERSION="${label}")
+    docker_build_command+=(--build-arg COMANAGE_REGISTRY_BASE_IMAGE_VERSION="${suffix}")
+    docker_build_command+=(--file container/registry/basic-auth/Dockerfile)
+    docker_build_command+=(.)
+
+    "${docker_build_command[@]}"
+
+    if (( $? != 0 )); then
+        exit 1
+    fi
+
+    if [[ -n "${prefix}" ]]; then
+        target="${prefix}${tag}"
+        docker tag "${tag}" "${target}"
+    fi
+}
+
+###########################################################################
+# Build the Registry cron image.
+# Globals:
+#   None
+# Arguments:
+#   Full image name prefix, a string.
+#   Tag label, a string.
+#   Tag suffix, a string.
+#   Docker build flags, other flags for docker build.
+# Outputs:
+#   None
+###########################################################################
+function build_crond() {
+    local docker_build_command
+    local docker_build_flags
+    local label
+    local prefix
+    local suffix
+
+    prefix="$1"
+    label="$2"
+    suffix="$3"
+
+    if [[ -z "${label}" ]]; then
+        err "ERROR:build_crond: label cannot be empty"
+        return 1
+    fi
+
+    if [[ -z "${suffix}" ]]; then
+        err "ERROR:build_crond: suffix cannot be empty"
+        return 1
+    fi
+
+    declare -a docker_build_flags=("${@:4}")
+
+    tag="comanage-registry-cron:${label}-${suffix}"
+
+    docker_build_command=(docker build)
+
+    if ((${#docker_build_flags[@]})); then
+        for flag in "${docker_build_flags[@]}"; do
+            docker_build_command+=("${flag}")
+        done
+    fi
+
+    docker_build_command+=(--tag "${tag}")
+    docker_build_command+=(--build-arg COMANAGE_REGISTRY_VERSION="${label}")
+    docker_build_command+=(--build-arg COMANAGE_REGISTRY_BASE_IMAGE_VERSION="${suffix}")
+    docker_build_command+=(--file container/registry/crond/Dockerfile)
+    docker_build_command+=(.)
+
+    "${docker_build_command[@]}"
+
+    if [[ -n "${prefix}" ]]; then
+        target="${prefix}${tag}"
+        docker tag "${tag}" "${target}"
+    fi
+}
+
+###########################################################################
+# Build the Registry mod_auth_openidc image.
+# Globals:
+#   None
+# Arguments:
+#   Full image name prefix, a string.
+#   Tag label, a string.
+#   Tag suffix, a string.
+#   Docker build flags, other flags for docker build.
+# Outputs:
+#   None
+###########################################################################
+function build_mod_auth_openidc() {
+    local docker_build_command
+    local docker_build_flags
+    local label
+    local prefix
+    local suffix
+
+    prefix="$1"
+    label="$2"
+    suffix="$3"
+
+    if [[ -z "${label}" ]]; then
+        err "ERROR:build_mod_auth_openidc: label cannot be empty"
+        return 1
+    fi
+
+    if [[ -z "${suffix}" ]]; then
+        err "ERROR:build_mod_auth_openidc: suffix cannot be empty"
+        return 1
+    fi
+
+    declare -a docker_build_flags=("${@:4}")
+
+    tag="comanage-registry:${label}-mod_auth_openidc-${suffix}"
+
+    docker_build_command=(docker build)
+
+    if ((${#docker_build_flags[@]})); then
+        for flag in "${docker_build_flags[@]}"; do
+            docker_build_command+=("${flag}")
+        done
+    fi
+
+    docker_build_command+=(--tag "${tag}")
+    docker_build_command+=(--build-arg COMANAGE_REGISTRY_VERSION="${label}")
+    docker_build_command+=(--build-arg COMANAGE_REGISTRY_BASE_IMAGE_VERSION="${suffix}")
+    docker_build_command+=(--file container/registry/mod_auth_openidc/Dockerfile)
+    docker_build_command+=(.)
+
+    "${docker_build_command[@]}"
+
+    if (( $? != 0 )); then
+        exit 1
+    fi
+
+    if [[ -n "${prefix}" ]]; then
+        target="${prefix}${tag}"
+        docker tag "${tag}" "${target}"
+    fi
+}
+
+###########################################################################
+# Build the Shibboleth SP base image.
+# Globals:
+#   None
+# Arguments:
+#   Full image name prefix, a string.
+#   Shibboleth SP version.
+#   Tag suffix, a string.
+#   Docker build flags, other flags for docker build.
+# Outputs:
+#   None
+###########################################################################
+function build_shibboleth_sp_base() {
+    local docker_build_command
+    local docker_build_flags
+    local label
+    local prefix
+    local suffix
+
+    prefix="$1"
+    label="$2"
+    suffix="$3"
+
+    if [[ -z "${label}" ]]; then
+        err "ERROR:build_shibboleth_sp_base: label cannot be empty"
+        return 1
+    fi
+
+    if [[ -z "${suffix}" ]]; then
+        err "ERROR:build_shibboleth_sp_base: suffix cannot be empty"
+        return 1
+    fi
+
+    declare -a docker_build_flags=("${@:4}")
+
+    tag="comanage-registry-shibboleth-sp-base:${label}-${suffix}"
+
+    docker_build_command=(docker build)
+
+    if ((${#docker_build_flags[@]})); then
+        for flag in "${docker_build_flags[@]}"; do
+            docker_build_command+=("${flag}")
+        done
+    fi
+
+    docker_build_command+=(--tag "${tag}")
+    docker_build_command+=(--build-arg SHIBBOLETH_SP_VERSION="${label}")
+    docker_build_command+=(--file container/shibboleth-sp-base/Dockerfile)
+    docker_build_command+=(.)
+
+    "${docker_build_command[@]}"
+
+    if (( $? != 0 )); then
+        exit 1
+    fi
+
+    if [[ -n "${prefix}" ]]; then
+        target="${prefix}${tag}"
+        docker tag "${tag}" "${target}"
+    fi
+}
+
+###########################################################################
+# Build the Shibboleth SP with supervisor image.
+# Globals:
+#   None
+# Arguments:
+#   Full image name prefix, a string.
+#   Tag label, a string.
+#   Tag suffix, a string.
+#   Shibboleth SP version.
+#   Shibboleth SP base image version.
+#   Docker build flags, other flags for docker build.
+# Outputs:
+#   None
+###########################################################################
+function build_shibboleth_sp_supervisor() {
+    local docker_build_command
+    local docker_build_flags
+    local label
+    local prefix
+    local shib_label
+    local shib_suffix
+    local suffix
+
+    prefix="$1"
+    label="$2"
+    suffix="$3"
+    shib_label="$4"
+    shib_suffix="$5"
+
+    if [[ -z "${label}" ]]; then
+        err "ERROR:build_shibboleth_sp_supervisor: label cannot be empty"
+        return 1
+    fi
+
+    if [[ -z "${suffix}" ]]; then
+        err "ERROR:build_shibboleth_sp_supervisor: suffix cannot be empty"
+        return 1
+    fi
+
+    if [[ -z "${shib_label}" ]]; then
+        err "ERROR:build_shibboleth_sp_supervisor: shib_label cannot be empty"
+        return 1
+    fi
+
+    if [[ -z "${shib_suffix}" ]]; then
+        err "ERROR:build_shibboleth_sp_supervisor: shib_suffix cannot be empty"
+        return 1
+    fi
+
+    declare -a docker_build_flags=("${@:6}")
+
+    tag="comanage-registry:${label}-shibboleth-sp-supervisor-${suffix}"
+
+    docker_build_command=(docker build)
+
+    if ((${#docker_build_flags[@]})); then
+        for flag in "${docker_build_flags[@]}"; do
+            docker_build_command+=("${flag}")
+        done
+    fi
+
+    docker_build_command+=(--tag "${tag}")
+    docker_build_command+=(--build-arg COMANAGE_REGISTRY_VERSION="${label}")
+    docker_build_command+=(--build-arg COMANAGE_REGISTRY_BASE_IMAGE_VERSION="${suffix}")
+    docker_build_command+=(--build-arg COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION="${shib_label}")
+    docker_build_command+=(--build-arg COMANAGE_REGISTRY_SHIBBOLETH_SP_BASE_IMAGE_VERSION="${shib_suffix}")
+    docker_build_command+=(--file container/registry/shibboleth-sp-supervisor/Dockerfile)
+    docker_build_command+=(.)
+
+    "${docker_build_command[@]}"
+
+    if (( $? != 0 )); then
+        exit 1
+    fi
+
+    if [[ -n "${prefix}" ]]; then
+        target="${prefix}${tag}"
+        docker tag "${tag}" "${target}"
+    fi
+}
+
+###########################################################################
+# Echo errors to stderr with timestamp.
+# Globals:
+#   None
+# Arguments:
+#   None
+# Outputs:
+#   Writes errors to stderr.
+###########################################################################
+function err() {
+    echo "[$(date +'%Y-%m-%dT%H:%M:%S%z')]: $*" >&2
+}
+
+###########################################################################
+# Echo usage message to stdout.
+# Globals:
+#   None
+# Arguments:
+#   Array of all input parameters
+# Outputs:
+#   Writes usage message to stdout.
+###########################################################################
+function usage() {
+    local usage
+
+    read -d '' usage <<EOF
+NAME
+    $0 - build COmanage Registry container images
+
+SYNOPSIS
+    $0 -s|--suffix=SUFFIX [OPTION]... PRODUCT
+
+DESCRIPTION
+    Build COmanage Registry container images.
+
+    PRODUCT is one of 
+        registry AUTHENTICATION
+        crond
+        slapd
+
+    where AUTHENTICATION is one of
+        basic-auth
+        shibboleth-sp-supervisor
+        mod_auth_openidc
+        all
+
+    The full name of the built images has the format
+
+    IMAGE_REGISTRY/REPOSITORY/NAME:TAG
+
+    When PRODUCT is registry NAME has the format
+
+    comanage-registry
+
+    and TAG has the format
+
+    LABEL-AUTHENTICATION-SUFFIX
+
+    If not specified LABEL is determined by inspecting
+    the source tree and has the format
+
+    GITHUB_TAG|GITHUB_BRANCH-COMMIT
+
+    -h, --help
+            show this usage message
+
+    --build-arg
+            pass build argument to docker build
+
+    --image_registry
+            image registry, default is none
+
+    -l, --label
+            label to use in image tag, default is determined
+            by inspecting the source tree and has the format
+            GITHUB_TAG for source tree tags or
+            GITHUB_BRANCH-COMMIT when building from a branch
+
+    --no-cache
+            passed to docker build if present
+
+    -o,--owner
+            synonym for repository
+
+    --repository
+            image repository, default is none,
+            required if image_registry is specified
+
+    --rm
+            passed to docker build if present
+
+    -s, --suffix
+            required image tag suffix
+
+EXAMPLES
+    $0 -s 1 registry all
+        Build all Registry images with tag suffix 1
+
+    $0 --suffix=2022-05-01 registry shibboleth-sp-supervisor
+        Build Registry image with Shibboleth SP authentication
+        and the tag suffix 2022-05-01. The Python Supervisor
+        system is used to start Apache HTTP Server and the
+        Shibboleth SP shibd daemon.
+
+    $0 -s 1 --repository=myorg registry basic-auth
+        Build Registry image with basic authentication,
+        repository myorg, and tag suffix 1. The full name of
+        the image will have the format
+        myorg/comanage-registry:LABEL-basic-auth-1
+
+    $0 -s 1 --image_registry=server.my.org --repository=myorg
+            registry basic-auth
+        Build Registry image with basic authentication,
+        repository myorg, image registry server.my.org, and tag suffix 1.
+        The full name of the image will have the format
+        my.server.org/myorg/comanage-registry:LABEL-basic-auth-1
+
+    $0 --suffix=mytag --no-cache registry mod_auth_openidc
+        Build Registry image with OIDC authentication and tag suffix
+        mytag and pass --no-cache to the docker build command
+
+    $0 -s 20220501 --label mylabel registry shibboleth-sp-supervisor
+        Build Registry image with Shibboleth SP authentication, tag
+        suffix 20220501, and label mylabel. The full name of the image
+        will have the format
+        comanage-registry:mylabel-shibboleth-sp-supervisor-20220501
+EOF
+
+    echo "${usage}"
+}
+
+###########################################################################
+# Use git to inspect repository state and return version string.
+# Globals:
+#   None
+# Arguments:
+#   None
+# Outputs:
+#   Writes version string to stdout.
+###########################################################################
+function label_from_repository() {
+    local branch
+    local label
+
+    git symbolic-ref -q HEAD > /dev/null 2>&1
+    if (( $? == 0 )); then
+        branch="$(git rev-parse --abbrev-ref HEAD)"
+        if [[ "${branch}" == "main" ]]; then
+            label="$(git describe --tags --abbrev=0)"
+        else
+            label="${branch}-$(git rev-parse --short HEAD)"
+        fi
+    else
+        label="$(git rev-parse --short HEAD)"
+    fi
+
+    echo "${label}"
+}
+
+###########################################################################
+# Parse command line and execute as specified.
+# Globals:
+#   SHIBBOLETH_SP_VERSION, string
+# Arguments:
+#   Array of all input parameters
+# Outputs:
+#   None
+###########################################################################
+function main() {
+    local authentication
+    local docker_build_flags
+    local gnu_getopt_out
+    local image_registry
+    local label=""
+    local prefix=""
+    local product
+    local repository
+    local suffix
+
+    # Require bash version 4 or higher.
+    if [[ ! "${BASH_VERSINFO:-0}" -ge 4 ]]; then
+        err "ERROR: Bash version must be 4 or greater"
+        exit 1
+    fi
+
+    # Require getopt version 2.32 or greater.
+    getopt_version=$(/usr/bin/getopt --version | cut -d' ' -f4 | cut -c1-4 | tr -d .)
+    if [[ ! "${getopt_version:-0}" -ge 232 ]]; then
+        err "ERROR: getopt version must be 2.32 or greater"
+        exit 1
+    fi
+
+    declare -a docker_build_flags=()
+
+    gnu_getopt_out=$(/usr/bin/getopt \
+                     --options hl:os: \
+                     --longoptions help \
+                     --longoptions build-arg: \
+                     --longoptions image_registry: \
+                     --longoptions label: \
+                     --longoptions no-cache \
+                     --longoptions owner: \
+                     --longoptions repository: \
+                     --longoptions rm \
+                     --longoptions suffix: \
+                     --name 'build.sh' -- "${@}")
+
+    if [[ $? != 0 ]]; then
+        err "ERROR: unable to parse command line"
+        exit 1
+    fi
+
+    eval set -- "${gnu_getopt_out}"
+
+    while true; do
+        case "$1" in
+            -h | --help ) usage $@; exit ;;
+            --build-arg ) docker_build_flags+=(--build-arg "$2") ; shift 2 ;;
+            --image_registry ) image_registry="$2"; shift 2 ;;
+            -l | --label ) label="$2"; shift 2 ;;
+            --no-cache ) docker_build_flags+=(--no-cache) ; shift 1 ;;
+            -o | --owner ) repository="$2"; shift 2 ;;
+            --repository ) repository="$2"; shift 2 ;;
+            --rm ) docker_build_flags+=(--rm) ; shift 1 ;;
+            -s | --suffix ) suffix="$2"; shift 2 ;;
+            -- ) shift; break ;;
+            * ) break ;;
+        esac
+    done
+
+    if [[ -z "${suffix}" ]]; then
+        err "ERROR: --suffix must be specified"
+        exit 1
+    fi
+
+    if [[ -z "${repository}" && -n "${image_registry}" ]]; then
+        err "ERROR: --repository must be specified if --image_registry is specified"
+        exit 1
+    fi
+    
+    if [[ -z "${label}" ]]; then
+        label="$(label_from_repository)"
+    fi
+
+    if [[ -n "${repository}" ]]; then
+        prefix="${repository}/"
+        if [[ -n "${image_registry}" ]]; then
+            prefix="${image_registry}/${prefix}"
+        fi
+    fi
+
+    product="$1"
+
+    case "${product}" in
+        crond )
+            build_base "${prefix}" "${label}" "${suffix}" "${docker_build_flags[@]}"
+            build_crond "${prefix}" "${label}" "${suffix}" "${docker_build_flags[@]}"
+            ;;
+        registry )
+            authentication="$2"
+            case "${authentication}" in
+                all )
+                    build_base "${prefix}" "${label}" "${suffix}" "${docker_build_flags[@]}" \
+                    && build_basic_auth "${prefix}" "${label}" "${suffix}" "${docker_build_flags[@]}" \
+                    && build_mod_auth_openidc "${prefix}" "${label}" "${suffix}" "${docker_build_flags[@]}" \
+                    && build_shibboleth_sp_base "${prefix}" "${SHIBBOLETH_SP_VERSION}" "${suffix}" "${docker_build_flags[@]}" \
+                    && build_shibboleth_sp_supervisor "${prefix}" "${label}" "${suffix}" "${SHIBBOLETH_SP_VERSION}" "${suffix}" "${docker_build_flags[@]}"
+                    ;;
+                basic-auth )
+                    build_base "${prefix}" "${label}" "${suffix}" "${docker_build_flags[@]}" \
+                    && build_basic_auth "${prefix}" "${label}" "${suffix}" "${docker_build_flags[@]}"
+                    ;;
+                mod_auth_openidc )
+                    build_base "${prefix}" "${label}" "${suffix}" "${docker_build_flags[@]}" \
+                    && build_mod_auth_openidc "${prefix}" "${label}" "${suffix}" "${docker_build_flags[@]}"
+                    ;;
+                shibboleth-sp-supervisor )
+                    build_base "${prefix}" "${label}" "${suffix}" "${docker_build_flags[@]}" \
+                    && build_shibboleth_sp_base "${prefix}" "${SHIBBOLETH_SP_VERSION}" "${suffix}" "${docker_build_flags[@]}" \
+                    && build_shibboleth_sp_supervisor "${prefix}" "${label}" "${suffix}" "${SHIBBOLETH_SP_VERSION}" "${suffix}" "${docker_build_flags[@]}"
+                    ;;
+                *)
+                    err "ERROR: Unrecognized authentication"
+                    echo
+                    usage
+                    ;;
+            esac
+            ;;
+        slapd )
+            ;;
+        *)
+            err "ERROR: unrecogized product"
+            echo
+            usage
+            ;;
+    esac
+}
+
+# Globals
+SHIBBOLETH_SP_VERSION=3.4.1
+
+main "$@"
diff --git a/container/registry/base/Dockerfile b/container/registry/base/Dockerfile
new file mode 100644
index 000000000..cb242babb
--- /dev/null
+++ b/container/registry/base/Dockerfile
@@ -0,0 +1,128 @@
+# COmanage Registry Dockerfile
+#
+# Portions licensed to the University Corporation for Advanced Internet
+# Development, Inc. ("UCAID") under one or more contributor license agreements.
+# See the NOTICE file distributed with this work for additional information
+# regarding copyright ownership.
+#
+# UCAID licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+ARG PHP_IMAGE_VERSION=8.1.19
+FROM php:${PHP_IMAGE_VERSION}-apache-bullseye
+
+# Official PHP image with Apache HTTPD includes
+# --with-openssl
+# --with-mbstring
+# but xls, pdo, pdo_mysql, pdo_pgsql, mysqli, pgsql, 
+# and ldap extensions must be built.
+RUN apt-get update && apt-get install -y \
+         libldap-2.4-2 \
+         libldap2-dev \
+         libmariadb-dev \
+         libpq-dev \
+         libxml2 \
+         libxslt1-dev \
+         libxslt1.1 \
+         ssl-cert \
+         wget \
+         zlib1g \
+         libpcre3-dev \
+      && docker-php-ext-configure pgsql -with-pgsql=/usr/local/pgsql \
+      && docker-php-ext-configure ldap --with-libdir=lib/x86_64-linux-gnu \
+      && docker-php-ext-configure mysqli \
+      && docker-php-ext-install intl xsl pdo pdo_mysql pdo_pgsql mysqli pgsql ldap pcntl \
+      && docker-php-source delete \
+      && apt-get purge -y \
+         libldap2-dev \
+         libmysqlclient-dev \
+         libpq-dev \
+      && apt-get clean
+
+# Configure TLS CA signing certificates for LDAP TLS libraries.
+ARG LDAPTLS_CACERT
+ENV LDAPTLS_CACERT ${LDAPTLS_CACERT:-/etc/ssl/certs/ca-certificates.crt}
+LABEL ldaptls_cacert=${LDAPTLS_CACERT}
+
+# Build the redis extension to use Redis for session storage.
+RUN docker-php-source extract \
+    && pecl bundle -d /usr/src/php/ext redis \
+    && docker-php-ext-install redis \
+    && docker-php-ext-enable redis \
+    && docker-php-source delete
+
+# Copy the production php.ini into place.
+RUN cp "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
+
+# Signal the PHP code to configure itself for container deployment.
+ENV COMANAGE_REGISTRY_CONTAINER 1
+
+ARG COMANAGE_REGISTRY_VERSION
+ENV COMANAGE_REGISTRY_VERSION ${COMANAGE_REGISTRY_VERSION:-develop}
+LABEL comanage_registry_version=${COMANAGE_REGISTRY_VERSION}
+
+ARG COMANAGE_REGISTRY_DIR
+ENV COMANAGE_REGISTRY_DIR ${COMANAGE_REGISTRY_DIR:-/srv/comanage-registry}
+LABEL comanage_registry_dir=${COMANAGE_REGISTRY_DIR}
+
+WORKDIR $COMANAGE_REGISTRY_DIR
+
+COPY app ${COMANAGE_REGISTRY_DIR}/app/
+COPY LICENSE ${COMANAGE_REGISTRY_DIR}/
+COPY NOTICE ${COMANAGE_REGISTRY_DIR}/
+
+RUN mkdir -p ${COMANAGE_REGISTRY_DIR}/local/tmp/sessions \
+    && mkdir -p ${COMANAGE_REGISTRY_DIR}/local/tmp/cache/persistent \
+    && mkdir -p ${COMANAGE_REGISTRY_DIR}/local/tmp/cache/views \
+    && mkdir -p ${COMANAGE_REGISTRY_DIR}/local/tmp/cache/models \
+    && mkdir -p ${COMANAGE_REGISTRY_DIR}/local/logs \
+    && mkdir -p ${COMANAGE_REGISTRY_DIR}/local/config \
+    && chown -R www-data:www-data ${COMANAGE_REGISTRY_DIR}/local/logs \
+    && chown -R www-data:www-data ${COMANAGE_REGISTRY_DIR}/local/tmp \
+    && cd /var/www/html \
+    && ln -s ${COMANAGE_REGISTRY_DIR}/app/webroot registry \
+    && chown -h www-data:www-data registry
+
+RUN a2enmod headers \
+      && a2enmod ssl \
+      && a2enmod rewrite \
+      && a2dissite 000-default.conf \
+      && a2disconf other-vhosts-access-log \
+      && cd /etc/apache2 \
+      && ln -s /etc/ssl/certs/ssl-cert-snakeoil.pem cert.pem \
+      && ln -s /etc/ssl/private/ssl-cert-snakeoil.key privkey.pem
+
+COPY container/registry/base/comanage_utils.sh /usr/local/lib/
+COPY container/registry/base/comanage_shibboleth_sp_utils.sh /usr/local/lib/
+COPY container/registry/base/docker-comanage-entrypoint /usr/local/bin/
+
+EXPOSE 80 443
+
+# Allow values for first administrator bootstrapped into the
+# platform to be specified at image build time, in addition to
+# being injected at run time through the entrypoint script.
+ARG COMANAGE_REGISTRY_ADMIN_GIVEN_NAME
+ARG COMANAGE_REGISTRY_ADMIN_FAMILY_NAME
+ARG COMANAGE_REGISTRY_ADMIN_USERNAME
+ARG COMANAGE_REGISTRY_ENABLE_POOLING
+
+# Set simple defaults for first administrator bootstrapped into the
+# platform to make simple evaluation of the platform easier.
+ENV COMANAGE_REGISTRY_ADMIN_GIVEN_NAME ${COMANAGE_REGISTRY_ADMIN_GIVEN_NAME:-Registry}
+ENV COMANAGE_REGISTRY_ADMIN_FAMILY_NAME ${COMANAGE_REGISTRY_ADMIN_FAMILY_NAME:-Admin}
+ENV COMANAGE_REGISTRY_ADMIN_USERNAME ${COMANAGE_REGISTRY_ADMIN_USERNAME:-registry.admin}
+
+# Force debuge mode to false.
+ENV DEBUG=false
+
+ENTRYPOINT ["docker-comanage-entrypoint"]
+
+CMD ["apache2-foreground"]
diff --git a/container/registry/base/comanage_shibboleth_sp_utils.sh b/container/registry/base/comanage_shibboleth_sp_utils.sh
new file mode 100755
index 000000000..88415b787
--- /dev/null
+++ b/container/registry/base/comanage_shibboleth_sp_utils.sh
@@ -0,0 +1,355 @@
+#!/bin/bash
+
+# COmanage Registry Shibboleth SP Dockerfile entrypoint
+#
+# Portions licensed to the University Corporation for Advanced Internet
+# Development, Inc. ("UCAID") under one or more contributor license agreements.
+# See the NOTICE file distributed with this work for additional information
+# regarding copyright ownership.
+#
+# UCAID licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if [ -n "$COMANAGE_DEBUG" ]
+then
+    OUTPUT=/dev/stdout
+else
+    OUTPUT=/dev/null
+fi
+
+##########################################
+# Consume injected environment variables
+# Globals:
+#   See function
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_shibboleth_sp_utils::consume_injected_environment() {
+
+    echo "Examining environment variables for Shibboleth SP..." > "$OUTPUT" 
+
+    # Configuration details that may be injected through environment
+    # variables or the contents of files.
+    #
+    # SHIBBOLETH_SP_METADATA_PROVIDER_XML may also be injected in the
+    # same way but because of the presence of special characters in the
+    # XML it is handled differently.
+
+    injectable_config_vars=( 
+        SHIBBOLETH_SP_ENTITY_ID
+        SHIBBOLETH_SP_CERT
+        SHIBBOLETH_SP_PRIVKEY
+        SHIBBOLETH_SP_SIGNING_CERT
+        SHIBBOLETH_SP_SIGNING_PRIVKEY
+        SHIBBOLETH_SP_ENCRYPT_CERT
+        SHIBBOLETH_SP_ENCRYPT_PRIVKEY
+        SHIBBOLETH_SP_SAMLDS_URL
+    )
+
+    # If the file associated with a configuration variable is present then 
+    # read the value from it into the appropriate variable. So for example
+    # if the variable COMANAGE_REGISTRY_DATASOURCE_FILE exists and its
+    # value points to a file on the file system then read the contents
+    # of that file into the variable COMANAGE_REGISTRY_DATASOURCE.
+
+    for config_var in "${injectable_config_vars[@]}"
+    do
+        eval file_name=\$"${config_var}_FILE";
+
+        if [ -e "$file_name" ]; then
+            payload=`cat $file_name`
+            declare "${config_var}"="${payload}"
+        fi
+    done
+
+    echo "Done examining environment variables" > "$OUTPUT"
+}
+
+##########################################
+# Prepare shibboleth2.xml configuration file
+# Globals:
+#   OUTPUT
+#   SHIBBOLETH_SP_ENTITY_ID
+#   SHIBBOLETH_SP_SAMLDS_URL
+#   SHIBBOLETH_SP_METADATA_PROVIDER_XML_FILE
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_shibboleth_sp_utils::prepare_shibboleth2xml() {
+    
+    local shib_file
+    local xml_content_file
+    local sed_script_file
+
+    # If no shibboleth2.xml file is present then create one using 
+    # injected information or defaults that are not particularly
+    # useful in a federated context but will allow shibd to start.
+    shib_file='/etc/shibboleth/shibboleth2.xml'
+
+    if [[ ! -e "${shib_file}" ]]; then
+        cp "${shib_file}.template" "${shib_file}" > "${OUTPUT}" 2>&1
+        sed -i -e s@%%SHIBBOLETH_SP_ENTITY_ID%%@"${SHIBBOLETH_SP_ENTITY_ID:-https://comanage.registry/shibboleth}"@ "${shib_file}" > "${OUTPUT}" 2>&1
+        sed -i -e s@%%SHIBBOLETH_SP_SAMLDS_URL%%@"${SHIBBOLETH_SP_SAMLDS_URL:-https://localhost/registry/pages/eds/index}"@ "${shib_file}" > "${OUTPUT}" 2>&1
+
+        # The metadata provider injected input most likely contains special characters
+        # so use a sed script instead of simple substitution on the command line.
+
+        if [[ -n "${SHIBBOLETH_SP_METADATA_PROVIDER_XML_FILE}" ]]; then
+            xml_content_file="${SHIBBOLETH_SP_METADATA_PROVIDER_XML_FILE}"
+        else
+            xml_content_file=`/bin/mktemp`
+            echo "${SHIBBOLETH_SP_METADATA_PROVIDER_XML:-}" > "${xml_content_file}"
+        fi
+
+        sed_script_file=`/bin/mktemp`
+        cat > ${sed_script_file}<<EOF
+/%%SHIBBOLETH_SP_METADATA_PROVIDER_XML%%/ {
+    r ${xml_content_file}
+    d
+}
+EOF
+
+        sed -i -f "${sed_script_file}" "${shib_file}" > "${OUTPUT}" 2>&1
+        
+        chmod 0644 "${shib_file}" > "${OUTPUT}" 2>&1
+
+        rm -f "${xml_content_file}" > "${OUTPUT}" 2>&1
+        rm -f "${sed_script_file}" > "${OUTPUT}" 2>&1
+
+    fi
+}
+
+##########################################
+# Prepare SAML certs and keys
+# Globals:
+#   SHIBBOLETH_SP_CERT
+#   SHIBBOLETH_SP_PRIVKEY
+#   SHIBBOLETH_SP_SIGNING_CERT
+#   SHIBBOLETH_SP_SIGNING_PRIVKEY
+#   SHIBBOLETH_SP_ENCRYPT_CERT
+#   SHIBBOLETH_SP_ENCRYPT_PRIVKEY
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_shibboleth_sp_utils::prepare_saml_cert_key() {
+
+    local saml_file
+    local owner
+
+    if [[ -e '/etc/debian_version' ]]; then
+        owner='_shibd'
+    elif [[ -e '/etc/centos-release' ]]; then
+        owner='shibd'
+    fi
+
+    # If defined use configured location of Shibboleth SP SAML certificate and key.
+    saml_file='/etc/shibboleth/sp-cert.pem'
+    if [[ -n "${SHIBBOLETH_SP_CERT}" ]]; then
+        cp "${SHIBBOLETH_SP_CERT}" "${saml_file}"
+        chown "${owner}" "${saml_file}"
+        chmod 0644 "${saml_file}"
+    fi
+
+    saml_file='/etc/shibboleth/sp-key.pem'
+    if [[ -n "${SHIBBOLETH_SP_PRIVKEY}" ]]; then
+        cp "${SHIBBOLETH_SP_PRIVKEY}" "${saml_file}"
+        chown "${owner}" "${saml_file}"
+        chmod 0600 "${saml_file}"
+    fi
+
+    saml_file='/etc/shibboleth/sp-signing-cert.pem'
+    if [[ -n "${SHIBBOLETH_SP_SIGNING_CERT}" ]]; then
+        cp "${SHIBBOLETH_SP_SIGNING_CERT}" "${saml_file}"
+        chown "${owner}" "${saml_file}"
+        chmod 0644 "${saml_file}"
+    fi
+
+    saml_file='/etc/shibboleth/sp-signing-key.pem'
+    if [[ -n "${SHIBBOLETH_SP_SIGNING_PRIVKEY}" ]]; then
+        cp "${SHIBBOLETH_SP_SIGNING_PRIVKEY}" "${saml_file}"
+        chown "${owner}" "${saml_file}"
+        chmod 0600 "${saml_file}"
+    fi
+
+    saml_file='/etc/shibboleth/sp-encrypt-cert.pem'
+    if [[ -n "${SHIBBOLETH_SP_ENCRYPT_CERT}" ]]; then
+        cp "${SHIBBOLETH_SP_ENCRYPT_CERT}" "${saml_file}"
+        chown "${owner}" "${saml_file}"
+        chmod 0644 "${saml_file}"
+    fi
+
+    saml_file='/etc/shibboleth/sp-encrypt-key.pem'
+    if [[ -n "${SHIBBOLETH_SP_ENCRYPT_PRIVKEY}" ]]; then
+        cp "${SHIBBOLETH_SP_ENCRYPT_PRIVKEY}" "${saml_file}"
+        chown "${owner}" "${saml_file}"
+        chmod 0600 "${saml_file}"
+    fi
+}
+
+##########################################
+# Process ect/shibboleth in slash root directory if exists
+# Globals:
+#   COMANAGE_REGISTRY_SLASH_ROOT_DIRECTORY
+#   OUTPUT
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_shibboleth_sp_utils::process_slash_root() {
+
+    local slash_root
+
+    slash_root="${COMANAGE_REGISTRY_SLASH_ROOT_DIRECTORY:-/opt/registry/slashRoot}"
+
+    # Exit if directory does not exist.
+    if [[ ! -d "${slash_root}/etc/shibboleth" ]]; then
+        return 0
+    fi
+
+    echo "Processing slash root directory ${slash_root}/etc/shibboleth..."
+
+    pushd "${slash_root}"
+
+    # Copy all files and symlinks and preserve all details but exclude any files
+    # for the Shibboleth SP if they exist to allow the Shib SP
+    # entrypoint script to process that path and prevent a race
+    # condition.
+    find etc/shibboleth -type f,l | xargs -I{} cp --preserve=all --parents --no-dereference {} / > ${OUTPUT} 2>&1
+
+    popd
+
+    echo "Done processing slash root directory ${slash_root}/etc/shibboleth"
+}
+
+##########################################
+# Manage UID and GID on files
+# Globals:
+#   None
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_shibboleth_sp_utils::manage_uid_gid() {
+
+    local owner
+    local ownership
+    local not_readable
+
+    # A deployer may make their own mapping between the shibd username
+    # and the UID, and between the shibd group and GID, so before starting 
+    # make sure files have the correct ownership and group. 
+
+    not_readable='/tmp/shibd-not-readable'
+
+    if [[ -e '/etc/debian_version' ]]; then
+        owner='_shibd'
+        ownership="${owner}:${owner}"
+
+        chown "${ownership}" /etc/shibboleth/sp-cert.pem > /dev/null 2>&1
+        chown "${ownership}" /etc/shibboleth/sp-key.pem > /dev/null 2>&1
+
+        chown "${ownership}" /etc/shibboleth/sp-signing-cert.pem > /dev/null 2>&1
+        chown "${ownership}" /etc/shibboleth/sp-signing-key.pem > /dev/null 2>&1
+
+        chown "${ownership}" /etc/shibboleth/sp-encrypt-cert.pem > /dev/null 2>&1
+        chown "${ownership}" /etc/shibboleth/sp-encrypt-key.pem > /dev/null 2>&1
+
+        chown "${ownership}" /opt/shibboleth-sp/var > /dev/null 2>&1
+        chown "${ownership}" /opt/shibboleth-sp/var > /dev/null 2>&1
+        chown "${ownership}" /opt/shibboleth-sp/var/run > /dev/null 2>&1
+        chown "${ownership}" /opt/shibboleth-sp/var/run/shibboleth > /dev/null 2>&1
+        chown "${ownership}" /opt/shibboleth-sp/var/run/shibboleth/shibd.sock > /dev/null 2>&1
+        chown "${ownership}" /opt/shibboleth-sp/var/log > /dev/null 2>&1
+        chown "${ownership}" /opt/shibboleth-sp/var/log/shibboleth > /dev/null 2>&1
+        chown "${ownership}" /opt/shibboleth-sp/var/log/shibboleth/transaction.log > /dev/null 2>&1
+        chown "${ownership}" /opt/shibboleth-sp/var/log/shibboleth/signature.log > /dev/null 2>&1
+        chown "${ownership}" /opt/shibboleth-sp/var/log/shibboleth/shibd_warn.log > /dev/null 2>&1
+        chown "${ownership}" /opt/shibboleth-sp/var/log/shibboleth/shibd.log > /dev/null 2>&1
+        chown "${ownership}" /opt/shibboleth-sp/var/log/shibboleth-www > /dev/null 2>&1
+        chown "${ownership}" /opt/shibboleth-sp/var/cache > /dev/null 2>&1
+        chown "${ownership}" /opt/shibboleth-sp/var/cache/shibboleth > /dev/null 2>&1
+    elif [[ -e '/etc/centos-release' ]]; then
+        owner='shibd'
+        ownership="${owner}:${owner}"
+
+        chown "${ownership}" /etc/shibboleth/sp-cert.pem > /dev/null 2>&1
+        chown "${ownership}" /etc/shibboleth/sp-key.pem > /dev/null 2>&1
+
+        chown "${ownership}" /etc/shibboleth/sp-signing-cert.pem > /dev/null 2>&1
+        chown "${ownership}" /etc/shibboleth/sp-signing-key.pem > /dev/null 2>&1
+
+        chown "${ownership}" /etc/shibboleth/sp-encrypt-cert.pem > /dev/null 2>&1
+        chown "${ownership}" /etc/shibboleth/sp-encrypt-key.pem > /dev/null 2>&1
+    fi
+
+    # Warn about any files the shibd user cannot read.
+    sudo -u "${owner}" find /etc/shibboleth ! -readable > "${not_readable}" 2>/dev/null
+    if [[ -s "${not_readable}" ]]; then
+        echo "WARNING: the following files are not readable by ${owner}"
+        cat "${not_readable}"
+        echo ""
+    fi
+
+    rm -f "${not_readable}" > /dev/null 2>&1
+}
+
+##########################################
+# Exec to start and become Shibboleth SP shibd
+# Globals:
+#   None
+# Arguments:
+#   Command and arguments to exec
+# Returns:
+#   Does not return
+##########################################
+function comanage_shibboleth_sp_utils::exec_shibboleth_sp_daemon() {
+
+    local user
+    local group
+    local shibd_daemon
+    local config
+    local pidfile
+
+    comanage_shibboleth_sp_utils::consume_injected_environment
+
+    comanage_shibboleth_sp_utils::process_slash_root
+
+    comanage_shibboleth_sp_utils::prepare_shibboleth2xml
+
+    comanage_shibboleth_sp_utils::prepare_saml_cert_key
+
+    comanage_shibboleth_sp_utils::manage_uid_gid
+
+    config='/etc/shibboleth/shibboleth2.xml'
+    pidfile='/var/run/shibboleth/shibd.pid'
+
+    if [[ -e '/etc/debian_version' ]]; then
+        user='_shibd'
+        group='_shibd'
+        shibd_daemon='/opt/shibboleth-sp/sbin/shibd'
+    elif [[ -e '/etc/centos-release' ]]; then
+        user='shibd'
+        group='shibd'
+        shibd_daemon='/usr/sbin/shibd'
+        export LD_LIBRARY_PATH=/opt/shibboleth/lib64
+    fi
+
+    exec "${shibd_daemon}" -f -u "${user}" -g "${group}" -c "${config}" -p "${pidfile}" -F
+}
diff --git a/container/registry/base/comanage_utils.sh b/container/registry/base/comanage_utils.sh
new file mode 100644
index 000000000..7678b29c5
--- /dev/null
+++ b/container/registry/base/comanage_utils.sh
@@ -0,0 +1,1256 @@
+#!/bin/bash
+
+# COmanage Registry bash shell utilities
+#
+# Portions licensed to the University Corporation for Advanced Internet
+# Development, Inc. ("UCAID") under one or more contributor license agreements.
+# See the NOTICE file distributed with this work for additional information
+# regarding copyright ownership.
+#
+# UCAID licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if [[ -n "${COMANAGE_DEBUG}" ]]; then
+    OUTPUT=/dev/stdout
+
+    # Turn on application debugging.
+    DEBUG=true
+    export DEBUG
+else
+    OUTPUT=/dev/null
+fi
+
+##########################################
+# Configure CakePHP cache disable
+# Globals:
+#   COMANAGE_REGISTRY_DIR
+#   OUTPUT
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::configure_cache_disable() {
+    sed -i -e '/Cache.disable/ s+/++g' "$COMANAGE_REGISTRY_DIR/app/Config/core.php" 
+}
+
+##########################################
+# Configure CakePHP debug level
+# Globals:
+#   COMANAGE_REGISTRY_DIR
+#   OUTPUT
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::configure_cakephp_debug() {
+    sed -i -e '/Configure::write(.debug/ s/0/2/' "$COMANAGE_REGISTRY_DIR/app/Config/core.php" 
+}
+
+##########################################
+# Configure CakePHP DebugKit
+# Globals:
+#   COMANAGE_REGISTRY_DIR
+#   OUTPUT
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::configure_cakephp_debugkit() {
+    sed -i -e '/\$components = array/ s/$/'"'"'DebugKit.Toolbar'"'"',/' "$COMANAGE_REGISTRY_DIR/app/Controller/AppController.php" 
+}
+
+##########################################
+# Consume injected environment variables
+# Globals:
+#   See function
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::consume_injected_environment() {
+    
+    echo "Examining environment variables..." > "$OUTPUT" 
+
+    # Configuration details that may be injected through environment
+    # variables or the contents of files.
+    local injectable_config_vars
+
+    injectable_config_vars=( 
+        COMANAGE_REGISTRY_ADMIN_GIVEN_NAME
+        COMANAGE_REGISTRY_ADMIN_FAMILY_NAME
+        COMANAGE_REGISTRY_ADMIN_USERNAME
+        COMANAGE_REGISTRY_CRON_USER
+        COMANAGE_REGISTRY_CRONTAB
+        COMANAGE_REGISTRY_DATASOURCE
+        COMANAGE_REGISTRY_DATABASE
+        COMANAGE_REGISTRY_DATABASE_HOST
+        COMANAGE_REGISTRY_DATABASE_PORT
+        COMANAGE_REGISTRY_DATABASE_USER
+        COMANAGE_REGISTRY_DATABASE_USER_PASSWORD
+        COMANAGE_REGISTRY_EMAIL_FROM
+        COMANAGE_REGISTRY_EMAIL_TRANSPORT
+        COMANAGE_REGISTRY_EMAIL_HOST
+        COMANAGE_REGISTRY_EMAIL_PORT
+        COMANAGE_REGISTRY_EMAIL_ACCOUNT
+        COMANAGE_REGISTRY_EMAIL_ACCOUNT_PASSWORD
+        COMANAGE_REGISTRY_HTTP_LISTEN_PORT
+        COMANAGE_REGISTRY_HTTP_NO
+        COMANAGE_REGISTRY_HTTPS_LISTEN_PORT
+        COMANAGE_REGISTRY_HTTPS_NO
+        COMANAGE_REGISTRY_OIDC_AUTH_REQUEST_PARAMS
+        COMANAGE_REGISTRY_OIDC_CLIENT_ID
+        COMANAGE_REGISTRY_OIDC_CLIENT_SECRET
+        COMANAGE_REGISTRY_OIDC_CRYPTO_PASSPHRASE
+        COMANAGE_REGISTRY_OIDC_FORWARD_HEADERS
+        COMANAGE_REGISTRY_OIDC_PROVIDER_METADATA_URL
+        COMANAGE_REGISTRY_OIDC_REMOTE_USER_CLAIM
+        COMANAGE_REGISTRY_OIDC_SCOPES
+        COMANAGE_REGISTRY_OIDC_SESSION_INACTIVITY_TIMEOUT
+        COMANAGE_REGISTRY_OIDC_SESSION_MAX_DURATION
+        COMANAGE_REGISTRY_NO_DATABASE_CONFIG
+        COMANAGE_REGISTRY_NO_EMAIL_CONFIG
+        COMANAGE_REGISTRY_REMOTE_IP
+        COMANAGE_REGISTRY_REMOTE_IP_HEADER
+        COMANAGE_REGISTRY_REMOTE_IP_INTERNAL_PROXY
+        COMANAGE_REGISTRY_REMOTE_IP_INTERNAL_PROXY_LIST
+        COMANAGE_REGISTRY_REMOTE_IP_PROXIES_HEADER
+        COMANAGE_REGISTRY_REMOTE_IP_PROXY_PROTOCOL
+        COMANAGE_REGISTRY_REMOTE_IP_PROXY_PROTOCOL_EXCEPTIONS
+        COMANAGE_REGISTRY_REMOTE_IP_TRUSTED_PROXY
+        COMANAGE_REGISTRY_REMOTE_IP_TRUSTED_PROXY_LIST
+        COMANAGE_REGISTRY_SECURITY_SALT
+        COMANAGE_REGISTRY_PHP_SESSION_REDIS_URL
+        COMANAGE_REGISTRY_SKIP_SETUP
+        COMANAGE_REGISTRY_SKIP_UPGRADE
+        COMANAGE_REGISTRY_SLASH_ROOT_DIRECTORY
+        COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN
+        COMANAGE_REGISTRY_VIRTUAL_HOST_REDIRECT_HTTP_NO
+        COMANAGE_REGISTRY_VIRTUAL_HOST_SCHEME
+        COMANAGE_REGISTRY_VIRTUAL_HOST_PORT
+        HTTPS_CERT_FILE
+        HTTPS_PRIVKEY_FILE
+        SERVER_NAME
+    )
+
+    # If the file associated with a configuration variable is present then 
+    # read the value from it into the appropriate variable. So for example
+    # if the variable COMANAGE_REGISTRY_DATASOURCE_FILE exists and its
+    # value points to a file on the file system then read the contents
+    # of that file into the variable COMANAGE_REGISTRY_DATASOURCE.
+
+    local config_var
+    for config_var in "${injectable_config_vars[@]}"
+    do
+        local file_name
+        eval file_name=\$"${config_var}_FILE";
+
+        if [[ -e "$file_name" ]]; then
+            declare -g "${config_var}"=`cat $file_name`
+            echo "Set ${config_var} to be contents of ${file_name}" > "$OUTPUT"
+        fi
+    done
+
+    echo "Done examining environment variables" > "$OUTPUT"
+}
+
+##########################################
+# Deploy crontab file
+# Globals:
+#   COMANAGE_REGISTRY_DIR
+#   COMANAGE_REGISTRY_CRON_USER
+#   COMANAGE_REGISTRY_CRONTAB
+#   OUTPUT
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::deploy_crontab() {
+
+    local crontab
+    local cronuser
+    
+    if [[ -n "${COMANAGE_REGISTRY_CRONTAB}" ]]; then
+        crontab="${COMANAGE_REGISTRY_CRONTAB}"
+    else
+        crontab="${COMANAGE_REGISTRY_DIR}/local/crontab"
+    fi
+
+    if [[ -n "${COMANAGE_REGISTRY_CRON_USER}" ]]; then
+        cronuser="${COMANAGE_REGISTRY_CRON_USER}"
+
+        echo "Removing image default crontab for user www-data ..." > "${OUTPUT}" 2>&1
+        /usr/bin/crontab -u www-data -r > "${OUTPUT}" 2>&1
+    else
+        cronuser="www-data"
+    fi
+
+    if [[ -f "${crontab}" ]]; then
+        echo "Deploying crontab ${crontab} for user ${cronuser} ..." > "${OUTPUT}" 2>&1
+        /usr/bin/crontab -u "${cronuser}" "${crontab}" > "${OUTPUT}" 2>&1
+    fi
+}
+
+##########################################
+# Enable the Apache HTTP Server virtual host
+# Globals:
+#   OUTPUT
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::enable_virtual_host() {
+
+    local a2site
+
+    a2site="000-comanage"
+
+    /usr/sbin/a2ensite "${a2site}" > "${OUTPUT}" 2>&1
+}
+
+##########################################
+# Exec to start and become Apache HTTP Server
+# Globals:
+#   COMANAGE_REGISTRY_NO_DATABASE_CONFIG
+#   COMANAGE_REGISTRY_NO_EMAIL_CONFIG
+# Arguments:
+#   Command and arguments to exec
+# Returns:
+#   Does not return
+##########################################
+function comanage_utils::exec_apache_http_server() {
+
+    comanage_utils::consume_injected_environment
+
+    comanage_utils::process_slash_root
+
+    comanage_utils::prepare_local_directory
+
+    if [[ -z ${COMANAGE_REGISTRY_NO_DATABASE_CONFIG} ]]; then
+        comanage_utils::prepare_database_config
+    fi
+
+    if [[ -z ${COMANAGE_REGISTRY_NO_EMAIL_CONFIG} ]]; then
+        comanage_utils::prepare_email_config
+    fi
+
+    comanage_utils::prepare_https_cert_key
+
+    comanage_utils::prepare_server_name
+
+    comanage_utils::prepare_mod_remoteip
+
+    comanage_utils::prepare_virtual_host
+
+    comanage_utils::enable_virtual_host
+
+    comanage_utils::prepare_php_session
+
+    comanage_utils::wait_database_connectivity
+
+    comanage_utils::registry_setup
+
+    comanage_utils::registry_clear_cache
+
+    comanage_utils::tmp_ownership
+
+    # first arg is `-f` or `--some-option`
+    if [ "${1#-}" != "$1" ]; then
+        set -- apache2-foreground "$@"
+    fi
+
+    exec "$@"
+}
+
+##########################################
+# Exec to start and become cron
+# Globals:
+#   None
+# Arguments:
+#   Command and arguments to exec
+# Returns:
+#   Does not return
+##########################################
+function comanage_utils::exec_cron() {
+
+    comanage_utils::consume_injected_environment
+
+    comanage_utils::process_slash_root
+
+    comanage_utils::prepare_local_directory
+
+    if [[ -z ${COMANAGE_REGISTRY_NO_DATABASE_CONFIG} ]]; then
+        comanage_utils::prepare_database_config
+    fi
+
+    if [[ -z ${COMANAGE_REGISTRY_NO_EMAIL_CONFIG} ]]; then
+        comanage_utils::prepare_email_config
+    fi
+
+    comanage_utils::wait_database_connectivity
+
+    comanage_utils::registry_clear_cache
+
+    comanage_utils::configure_cache_disable
+
+    comanage_utils::tmp_ownership
+
+    comanage_utils::deploy_crontab
+
+    comanage_utils::start_syslogd
+
+    exec "$@"
+}
+
+##########################################
+# Prepare database configuration
+# Globals:
+#   COMANAGE_REGISTRY_DATABASE
+#   COMANAGE_REGISTRY_DATABASE_HOST
+#   COMANAGE_REGISTRY_DATABASE_PORT
+#   COMANAGE_REGISTRY_DATABASE_USER
+#   COMANAGE_REGISTRY_DATABASE_USER_PASSWORD
+#   COMANAGE_REGISTRY_DATASOURCE
+#   COMANAGE_REGISTRY_DIR
+#   OUTPUT
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::prepare_database_config() {
+
+    # If the COmanage Registry database configuration file does not exist
+    # then try to create it from injected information with reasonable defaults
+    # that aid simple evaluation deployments.
+    local database_config
+    database_config="$COMANAGE_REGISTRY_DIR/local/config/database.php"
+
+    # File already exists so return.
+    if [[ -e "$database_config" ]]; then
+        return
+    fi
+
+    # File does not exist so create it.
+    local php_string
+
+    read -r -d '' php_string <<'EOF'
+<?php
+return [
+    'Datasources' => [
+        'default' => [
+            'className' => 'Cake\Database\Connection',
+EOF
+
+    php_string+=$'\n            '
+    php_string+="'driver' => '${COMANAGE_REGISTRY_DATABASE_DRIVER:-Cake\Database\Driver\Postgres}',"
+
+    php_string+=$'\n            '
+    php_string+="'persistent' => ${COMANAGE_REGISTRY_DATABASE_PERSISTENT:-false},"
+
+    php_string+=$'\n            '
+    php_string+="'host' => '${COMANAGE_REGISTRY_DATABASE_HOST:-registry-database}',"
+
+    php_string+=$'\n            '
+    php_string+="'username' => '${COMANAGE_REGISTRY_DATABASE_USER:-registry_user}',"
+
+    php_string+=$'\n            '
+    php_string+="'password' => '${COMANAGE_REGISTRY_DATABASE_USER_PASSWORD:-password}'," 
+
+    php_string+=$'\n            '
+    php_string+="'database' => '${COMANAGE_REGISTRY_DATABASE:-registry}',"
+
+    # The value of port is an integer.
+    if [[ -n "${COMANAGE_REGISTRY_DATABASE_PORT}" ]]; then
+        php_string+=$'\n            '
+        php_string+="'port' => ${COMANAGE_REGISTRY_DATABASE_PORT},"
+    fi
+
+    php_string+=$'\n            '
+    php_string+="'encoding' => '${COMANAGE_REGISTRY_DATABASE_ENCODING:-utf8}',"
+
+    php_string+=$'\n            '
+    php_string+="'timezone' => '${COMANAGE_REGISTRY_DATABASE_ENCODING:-UTC}',"
+
+    # Only used when the database driver is Postgres.
+    if [[ ((${COMANAGE_REGISTRY_DATABASE_DRIVER} == 'Cake\Database\Driver\Postgres') ||
+         -z ${COMANAGE_REGISTRY_DATABASE_DRIVER}) &&
+         -n ${COMANAGE_REGISTRY_DATABASE_SCHEMA} ]]; then
+        php_string+=$'\n            '
+        php_string+="'schema' => '${COMANAGE_REGISTRY_DATABASE_SCHEMA}',"
+    fi
+
+    if [[ -n ${COMANAGE_REGISTRY_DATABASE_UNIX_SOCKET} ]]; then
+        php_string+=$'\n            '
+        php_string+="'unix_socket' => '${COMANAGE_REGISTRY_DATABASE_UNIX_SOCKET}',"
+    fi
+
+    # Only used when the database driver is MySQL.
+    if [[ (${COMANAGE_REGISTRY_DATABASE_DRIVER} == 'Cake\Database\Driver\Mysql') &&
+          -n ${COMANAGE_REGISTRY_DATABASE_SSL_KEY} ]]; then
+        php_string+=$'\n            '
+        php_string+="'ssl_key' => '${COMANAGE_REGISTRY_DATABASE_SSL_KEY}',"
+    fi
+
+    # Only used when the database driver is MySQL.
+    if [[ (${COMANAGE_REGISTRY_DATABASE_DRIVER} == 'Cake\Database\Driver\Mysql') &&
+          -n ${COMANAGE_REGISTRY_DATABASE_SSL_CERT} ]]; then
+        php_string+=$'\n            '
+        php_string+="'ssl_cert' => '${COMANAGE_REGISTRY_DATABASE_SSL_CERT}',"
+    fi
+
+    # Only used when the database driver is MySQL.
+    if [[ (${COMANAGE_REGISTRY_DATABASE_DRIVER} == 'Cake\Database\Driver\Mysql') &&
+          -n ${COMANAGE_REGISTRY_DATABASE_SSL_CA} ]]; then
+        php_string+=$'\n            '
+        php_string+="'ssl_ca' => '${COMANAGE_REGISTRY_DATABASE_SSL_CA}',"
+    fi
+
+    php_string+=$'\n            '
+    php_string+="'log' => ${COMANAGE_REGISTRY_DATABASE_LOG:-false},"
+
+    php_string+=$'\n            '
+    php_string+="'quoteIdentifiers' => ${COMANAGE_REGISTRY_DATABASE_QUOTE_IDENTIFIERS:-false},"
+
+    php_string+=$'\n            '
+    php_string+="'cacheMetadata' => ${COMANAGE_REGISTRY_DATABASE_CACHE_METADATA:-true},"
+
+    php_string+=$'\n        ]\n    ]\n];\n';
+
+    printf "%s" "$php_string" > $database_config
+
+    echo "Wrote new database configuration file ${database_config}" > "$OUTPUT"
+}
+
+##########################################
+# Prepare email configuration
+# Globals:
+#   COMANAGE_REGISTRY_EMAIL_ACCOUNT
+#   COMANAGE_REGISTRY_EMAIL_ACCOUNT_PASSWORD
+#   COMANAGE_REGISTRY_EMAIL_FROM
+#   COMANAGE_REGISTRY_EMAIL_HOST
+#   COMANAGE_REGISTRY_EMAIL_PORT
+#   COMANAGE_REGISTRY_EMAIL_TRANSPORT
+#   COMANAGE_REGISTRY_DIR
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::prepare_email_config() {
+
+    # If the COmanage Registry email configuration file does not exist
+    # then try to create it from injected information with reasonable defaults
+    # that aid simple evaluation deployments.
+    local email_config
+    email_config="$COMANAGE_REGISTRY_DIR/local/config/email.php"
+
+    # File already exists so return.
+    if [[ -e "$email_config" ]]; then
+        return
+    fi
+
+    # File does not exist so create it.
+    local php_string
+
+    read -r -d '' php_string <<'EOF'
+<?php
+  return [
+    'EmailTransport' => [
+      'default' => [
+EOF
+    php_string+=$'\n        '
+    php_string+="'transport' => '${COMANAGE_REGISTRY_EMAIL_TRANSPORT:-Smtp}',"
+
+    if [[ -n "${COMANAGE_REGISTRY_EMAIL_HOST}" ]]; then
+        php_string+=$'\n        '
+        php_string+="'host' => '${COMANAGE_REGISTRY_EMAIL_HOST}',"
+    fi
+
+    # The value of port is an integer.
+    if [[ -n "${COMANAGE_REGISTRY_EMAIL_PORT}" ]]; then
+        php_string+=$'\n        '
+        php_string+="'port' => ${COMANAGE_REGISTRY_EMAIL_PORT},"
+    fi
+
+    # The value of timeout is an integer.
+    if [[ -n "${COMANAGE_REGISTRY_EMAIL_TIMEOUT}" ]]; then
+        php_string+=$'\n        '
+        php_string+="'timeout' => ${COMANAGE_REGISTRY_EMAIL_TIMEOUT},"
+    fi
+
+    if [[ -n "${COMANAGE_REGISTRY_EMAIL_ACCOUNT}" ]]; then
+        php_string+=$'\n        '
+        php_string+="'username' => '${COMANAGE_REGISTRY_EMAIL_ACCOUNT}',"
+    fi
+
+    if [[ -n "${COMANAGE_REGISTRY_EMAIL_ACCOUNT_PASSWORD}" ]]; then
+        php_string+=$'\n        '
+        php_string+="'password' => '${COMANAGE_REGISTRY_EMAIL_ACCOUNT_PASSWORD}',"
+    fi
+
+    # The value of tls is a PHP boolean.
+    php_string+=$'\n        '
+    php_string+="'tls' => ${COMANAGE_REGISTRY_EMAIL_TLS:-true},"
+
+    php_string+=$'\n        ],'
+    php_string+=$'\n    ],'
+    php_string+=$'\n    '
+    php_string+=$"'Email' => ["
+    php_string+=$'\n      '
+    php_string+=$"'default' => ["
+    php_string+=$'\n        '
+    php_string+=$"'transport' => 'default',"
+
+    php_string+=$'\n        '
+
+    # Prefer the array of sender email and name if available, but
+    # if not then prefer the sender email over the older default
+    # and if neither is set use a default since the 'from' 
+    # configuration key is always required.
+    if [[ -n "${COMANAGE_REGISTRY_EMAIL_FROM_EMAIL}" && -n "${COMANAGE_REGISTRY_EMAIL_FROM_NAME}" ]]; then
+        php_string+="'from' => ['${COMANAGE_REGISTRY_EMAIL_FROM_EMAIL}' => '${COMANAGE_REGISTRY_EMAIL_FROM_NAME}'],"
+    elif [[ -n "${COMANAGE_REGISTRY_EMAIL_FROM_EMAIL}" && -z "${COMANAGE_REGISTRY_EMAIL_FROM_NAME}" ]]; then
+        php_string+="'from' => '${COMANAGE_REGISTRY_EMAIL_FROM_EMAIL}',"
+    elif [[ -n "${COMANAGE_REGISTRY_EMAIL_FROM}" && -z "${COMANAGE_REGISTRY_EMAIL_FROM_EMAIL}" ]]; then
+        php_string+="'from' => '${COMANAGE_REGISTRY_EMAIL_FROM}',"
+    elif [[ -z "${COMANAGE_REGISTRY_EMAIL_FROM}" ]]; then
+        php_string+="'from' => 'you@localhost',"
+    fi
+
+    php_string+=$'\n      ],\n    ],\n  ];\n'
+
+    printf "%s" "$php_string" > $email_config
+}
+
+##########################################
+# Prepare cert and key for HTTPS
+# Globals:
+#   HTTPS_CERT_FILE
+#   HTTPS_PRIVKEY_FILE
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::prepare_https_cert_key() {
+
+    local cert_path
+    local privkey_path
+    local web_user
+
+    if [[ -e '/etc/debian_version' ]]; then
+        cert_path='/etc/apache2/cert.pem'
+        privkey_path='/etc/apache2/privkey.pem'
+        web_user='www-data'
+    elif [[ -e '/etc/centos-release' ]]; then
+        cert_path='/etc/httpd/cert.pem'
+        privkey_path='/etc/httpd/privkey.pem'
+        web_user='apache'
+    fi
+
+    # If defined use configured location of Apache HTTP Server 
+    # HTTPS certificate and key files. The certificate file may also
+    # include intermediate CA certificates, sorted from leaf to root.
+    if [[ -n "${HTTPS_CERT_FILE}" ]]; then
+        rm -f "${cert_path}"
+        cp "${HTTPS_CERT_FILE}" "${cert_path}"
+        chown "${web_user}" "${cert_path}"
+        chmod 0644 "${cert_path}"
+        echo "Copied HTTPS certificate file ${HTTPS_CERT_FILE} to ${cert_path}" > "$OUTPUT"
+        echo "Set ownership of ${cert_path} to ${web_user}" > "$OUTPUT"
+    fi
+
+    if [[ -n "${HTTPS_PRIVKEY_FILE}" ]]; then
+        rm -f "${privkey_path}"
+        cp "${HTTPS_PRIVKEY_FILE}" "${privkey_path}"
+        chown "${web_user}" "${privkey_path}"
+        chmod 0600 "${privkey_path}"
+        echo "Copied HTTPS private key file ${HTTPS_PRIVKEY_FILE} to ${privkey_path}" > "$OUTPUT"
+        echo "Set ownership of ${privkey_path} to ${web_user}" > "$OUTPUT"
+    fi
+}
+
+##########################################
+# Prepare local directory structure
+# Globals:
+#   COMANAGE_REGISTRY_DIR
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::prepare_local_directory() {
+
+    # Make sure the directory structure we need is available
+    # in the data volume for $COMANAGE_REGISTRY_DIR/local
+    local directories
+
+    declare -a directories=("config")
+
+    local dir
+    local full_path
+    for dir in "${directories[@]}"
+    do
+        full_path="${COMANAGE_REGISTRY_DIR}/local/${dir}"
+        if [[ ! -d "${full_path}" ]]; then
+            mkdir -p "${full_path}" > "$OUTPUT" 2>&1
+            echo "Created directory ${full_path}"
+        fi
+    done
+}
+
+##########################################
+# Prepare mod_remoteip
+# Globals:
+#   COMANAGE_REGISTRY_REMOTE_IP
+#   COMANAGE_REGISTRY_REMOTE_IP_HEADER
+#   COMANAGE_REGISTRY_REMOTE_IP_INTERNAL_PROXY
+#   COMANAGE_REGISTRY_REMOTE_IP_INTERNAL_PROXY_LIST
+#   COMANAGE_REGISTRY_REMOTE_IP_PROXIES_HEADER
+#   COMANAGE_REGISTRY_REMOTE_IP_PROXY_PROTOCOL
+#   COMANAGE_REGISTRY_REMOTE_IP_PROXY_PROTOCOL_EXCEPTIONS
+#   COMANAGE_REGISTRY_REMOTE_IP_TRUSTED_PROXY
+#   COMANAGE_REGISTRY_REMOTE_IP_TRUSTED_PROXY_LIST
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::prepare_mod_remoteip() {
+
+    local remoteip_config
+    remoteip_config="/etc/apache2/mods-available/remoteip.conf"
+
+    if [[ -n "${COMANAGE_REGISTRY_REMOTE_IP}" ]]; then
+        echo "RemoteIPHeader ${COMANAGE_REGISTRY_REMOTE_IP_HEADER:-X-Forwarded-For}" >> $remoteip_config
+
+        if [[ -n "${COMANAGE_REGISTRY_REMOTE_IP_INTERNAL_PROXY}" ]]; then
+            echo "RemoteIPInternalProxy ${COMANAGE_REGISTRY_REMOTE_IP_INTERNAL_PROXY}" >> $remoteip_config
+        fi
+
+        if [[ -n "${COMANAGE_REGISTRY_REMOTE_IP_INTERNAL_PROXY_LIST}" ]]; then
+            echo "RemoteIPInternalProxyList ${COMANAGE_REGISTRY_REMOTE_IP_INTERNAL_PROXY_LIST}" >> $remoteip_config
+        fi
+
+        if [[ -n "${COMANAGE_REGISTRY_REMOTE_IP_PROXIES_HEADER}" ]]; then
+            echo "RemoteIPProxiesHeader ${COMANAGE_REGISTRY_REMOTE_IP_PROXIES_HEADER}" >> $remoteip_config
+        fi
+
+        if [[ -n "${COMANAGE_REGISTRY_REMOTE_IP_PROXY_PROTOCOL}" ]]; then
+            echo "RemoteIPProxyProtocol ${COMANAGE_REGISTRY_REMOTE_IP_PROXY_PROTOCOL}" >> $remoteip_config
+        fi
+
+        if [[ -n "${COMANAGE_REGISTRY_REMOTE_IP_PROXY_PROTOCOL_EXCEPTIONS}" ]]; then
+            echo "RemoteIPProxyProcotolException ${COMANAGE_REGISTRY_REMOTE_IP_PROXY_PROTOCOL_EXCEPTIONS}" >> $remoteip_config
+        fi
+
+        if [[ -n "${COMANAGE_REGISTRY_REMOTE_IP_TRUSTED_PROXY}" ]]; then
+            echo "RemoteIPTrustedProxy ${COMANAGE_REGISTRY_REMOTE_IP_TRUSTED_PROXY}" >> $remoteip_config
+        fi
+
+        if [[ -n "${COMANAGE_REGISTRY_REMOTE_IP_TRUSTED_PROXY_LIST}" ]]; then
+            echo "RemoteIPTrustedProxyList ${COMANAGE_REGISTRY_REMOTE_IP_TRUSTED_PROXY_LIST}" >> $remoteip_config
+        fi
+
+        /usr/sbin/a2enmod remoteip > "$OUTPUT" 2>&1
+    fi
+}
+
+##########################################
+# Prepare PHP session storage
+# Globals:
+#   COMANAGE_REGISTRY_PHP_SESSION_REDIS_URL
+#   OUTPUT
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::prepare_php_session() {
+
+    local php_ini
+    php_ini="/usr/local/etc/php"
+
+    # Configure Redis for sessions if so configured.
+    if [[ -n "${COMANAGE_REGISTRY_PHP_SESSION_REDIS_URL}" ]]; then
+        sed -i -e '/session.save_handler/ s+files+redis+' $php_ini > ${OUTPUT} 2>&1
+        sed -i -e "/session.save_handler/a session.save_path = ${COMANAGE_REGISTRY_PHP_SESSION_REDIS_URL}" $phi_ini > ${OUTPUT} 2>&1
+    fi
+}
+
+##########################################
+# Prepare web server name
+# Globals:
+#   SERVER_NAME
+#   COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::prepare_server_name() {
+    
+    # SERVER_NAME is deprecated in favor of COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN
+    # and will not be supported in a future version.
+    if [[ -n "$SERVER_NAME" ]]; then
+        echo "SERVER_NAME is deprecated and will not be supported in a future version"
+        echo "Use COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN instead of SERVER_NAME"
+        if [[ -z "$COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN" ]]; then
+            COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN="${SERVER_NAME}"
+            echo "SERVER_NAME=${SERVER_NAME} has been injected" > "$OUTPUT"
+            echo "Setting COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN=${COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN}"
+        fi
+    fi
+
+    # If COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN has not been injected try to determine
+    # it from the HTTPS_CERT_FILE.
+    if [[ -z "$COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN" ]]; then
+        COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN=$(openssl x509 -in /etc/apache2/cert.pem -text -noout | 
+                      sed -n '/X509v3 Subject Alternative Name:/ {n;p}' | 
+                      sed -E 's/.*DNS:(.*)\s*$/\1/')
+        if [[ -n "$COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN" ]]; then
+            echo "Set COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN=${COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN} using Subject Alternative Name from x509 certificate" > "$OUTPUT"
+        else
+            COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN=$(openssl x509 -in /etc/apache2/cert.pem -subject -noout | 
+                          sed -E 's/subject=.*CN=(.*)\s*/\1/')
+            if [[ -n "$COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN" ]]; then
+                echo "Set COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN=${COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN} using CN from x509 certificate" > "$OUTPUT"
+            fi
+        fi
+    fi
+
+    # Configure Apache HTTP Server with the server name.
+    # This configures the server name for the default Debian
+    # Apache HTTP Server configuration but not the server name used
+    # by any virtual hosts.
+    if [[ -e '/etc/debian_version' ]]; then
+        cat > /etc/apache2/conf-available/server-name.conf <<EOF
+ServerName ${COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN:-unknown}
+EOF
+        a2enconf server-name.conf > "$OUTPUT" 2>&1
+    fi
+
+    # Export the server name so that it may be used by 
+    # Apache HTTP Server virtual host configurations.
+    export COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN
+}
+
+##########################################
+# Prepare web server virtual host configuration
+# Globals:
+#   COMANAGE_REGISTRY_HTTP_LISTEN_PORT
+#   COMANAGE_REGISTRY_HTTP_NO
+#   COMANAGE_REGISTRY_HTTPS_LISTEN_PORT
+#   COMANAGE_REGISTRY_HTTPS_NO
+#   COMANAGE_REGISTRY_VIRTUAL_HOST_REDIRECT_HTTP_NO
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::prepare_virtual_host() {
+
+    local ports_config
+    local virtual_host_config
+
+    ports_config="/etc/apache2/ports.conf"
+    virtual_host_config="/etc/apache2/sites-available/000-comanage.conf"
+
+    # Configure the listening ports.
+    /bin/rm -f $ports_config > "${OUTPUT}" 2>&1
+
+    if [[ -z "${COMANAGE_REGISTRY_HTTP_NO}" ]]; then
+        echo "Listen ${COMANAGE_REGISTRY_HTTP_LISTEN_PORT:-80}" >> $ports_config
+    fi
+
+    if [[ -z "${COMANAGE_REGISTRY_HTTPS_NO}" ]]; then
+        echo "Listen ${COMANAGE_REGISTRY_HTTPS_LISTEN_PORT:-443}" >> $ports_config
+    fi
+
+    # Do not overwrite an existing virtual host configuration.
+    if [[ -e $virtual_host_config ]]; then
+        return 0
+    fi
+
+    if [[ -z "${COMANAGE_REGISTRY_HTTP_NO}" ]]; then
+        # Write configuration for HTTP virtual host.
+        comanage_utils::virtual_host_http_opening $virtual_host_config
+
+        if [[ -z "${COMANAGE_REGISTRY_VIRTUAL_HOST_REDIRECT_HTTP_NO}" ]]; then
+            # Write configuration for redirecting HTTP to HTTPS.
+            comanage_utils::virtual_host_http_redirect $virtual_host_config
+        else
+            # Write full configuration for HTTP including authentication.
+            comanage_utils::virtual_host_general_config $virtual_host_config
+            comanage_utils::virtual_host_authentication $virtual_host_config
+        fi
+
+        # Write close for virtual host.
+        comanage_utils::virtual_host_close $virtual_host_config
+
+    fi
+
+    if [[ -z "${COMANAGE_REGISTRY_HTTPS_NO}" ]]; then
+        # Write configuration for HTTPS.
+        comanage_utils::virtual_host_https_opening $virtual_host_config
+        comanage_utils::virtual_host_general_config $virtual_host_config
+        comanage_utils::virtual_host_authentication $virtual_host_config
+        comanage_utils::virtual_host_close $virtual_host_config
+    fi
+}
+
+##########################################
+# Process slash root directory if exists
+# Globals:
+#   COMANAGE_REGISTRY_SLASH_ROOT_DIRECTORY
+#   OUTPUT
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::process_slash_root() {
+
+    local slash_root
+
+    slash_root="${COMANAGE_REGISTRY_SLASH_ROOT_DIRECTORY:-/opt/registry/slashRoot}"
+
+    # Exit if directory does not exist.
+    if [[ ! -d "${slash_root}" ]]; then
+        return 0
+    fi
+
+    echo "Processing slash root directory ${slash_root}..."
+
+    pushd "${slash_root}"
+
+    # Copy all files and symlinks and preserve all details but exclude any files
+    # for the Shibboleth SP if they exist to allow the Shib SP
+    # entrypoint script to process that path and prevent a race
+    # condition.
+    find . -type f,l -not -path "./etc/shibboleth/*" | xargs -I{} cp --preserve=all --parents --no-dereference {} / > ${OUTPUT} 2>&1
+
+    popd
+
+    echo "Done processing slash root directory ${slash_root}"
+}
+
+##########################################
+# Clear CakePHP cache files
+# Globals:
+#   COMANAGE_REGISTRY_DIR
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::registry_clear_cache() {
+
+    pushd "${COMANAGE_REGISTRY_DIR}/app" > "$OUTPUT" 2>&1
+
+    ./bin/cake cache clear_all > "$OUTPUT" 2>&1
+    ./bin/cake schema_cache clear > "$OUTPUT" 2>&1
+
+    echo "Cleared COmanage Registry CakePHP cache files" > "$OUTPUT"
+
+    popd > "$OUTPUT" 2>&1
+}
+
+##########################################
+# Run COmanage Registry setup shell command
+# Globals:
+#   COMANAGE_REGISTRY_ADMIN_GIVEN_NAME
+#   COMANAGE_REGISTRY_ADMIN_FAMILY_NAME
+#   COMANAGE_REGISTRY_ADMIN_USERNAME
+#   COMANAGE_REGISTRY_DIR
+#   COMANAGE_REGISTRY_ENABLE_POOLING
+#   COMANAGE_REGISTRY_SECURITY_SALT
+#   COMANAGE_REGISTRY_SKIP_SETUP
+#   OUTPUT
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::registry_setup() {
+
+    if [[ -n "${COMANAGE_REGISTRY_SKIP_SETUP}" ]]; then
+        echo "Skipping database setup step" > "$OUTPUT" 2>&1
+        return 0
+    fi
+
+    pushd "$COMANAGE_REGISTRY_DIR/app" > "$OUTPUT" 2>&1
+    echo "Running ./bin/cake database..." > "$OUTPUT" 2>&1
+    ./bin/cake database > "$OUTPUT" 2>&1
+
+    # The setup command will create a salt file if the SECURITY_SALT
+    # environment variable is not set so we do that first.
+    if [[ -n "$COMANAGE_REGISTRY_SECURITY_SALT" ]]; then
+        export SECURITY_SALT="${COMANAGE_REGISTRY_SECURITY_SALT}"
+    fi
+
+    echo "Running ./bin/cake setup..." > "$OUTPUT" 2>&1
+    ./bin/cake setup --admin-given-name "${COMANAGE_REGISTRY_ADMIN_GIVEN_NAME}" \
+                     --admin-family-name "${COMANAGE_REGISTRY_ADMIN_FAMILY_NAME}" \
+                     --admin-username "${COMANAGE_REGISTRY_ADMIN_USERNAME}" > "$OUTPUT" 2>&1
+
+    popd > "$OUTPUT" 2>&1
+}
+
+##########################################
+# Start syslogd from busybox for use with cron
+# Globals:
+#   None
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::start_syslogd() {
+
+    /sbin/syslogd -O /proc/1/fd/1 -S
+
+}
+
+##########################################
+# Set tmp directory file ownership
+# Globals:
+#   COMANAGE_REGISTRY_DIR
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::tmp_ownership() {
+
+    # Ensure that the web server user owns the tmp directory
+    # and all children.
+    local tmp_dir
+    local ownership
+
+    ownership='www-data:www-data'
+    tmp_dir="${COMANAGE_REGISTRY_DIR}/app/tmp"
+
+    mkdir -p "${tmp_dir}"
+    chown -R "${ownership}" "${tmp_dir}"
+
+    echo "Recursively set ownership of ${tmp_dir} to ${ownership}" > "$OUTPUT"
+}
+
+##########################################
+# Write virtual host authentication stanza
+# Globals:
+#  COMANAGE_REGISTRY_OIDC_AUTH_REQUEST_PARAMS
+#  COMANAGE_REGISTRY_OIDC_CLIENT_ID
+#  COMANAGE_REGISTRY_OIDC_CLIENT_SECRET
+#  COMANAGE_REGISTRY_OIDC_CRYPTO_PASSPHRASE
+#  COMANAGE_REGISTRY_OIDC_FORWARD_HEADERS
+#  COMANAGE_REGISTRY_OIDC_PROVIDER_METADATA_URL
+#  COMANAGE_REGISTRY_OIDC_REMOTE_USER_CLAIM
+#  COMANAGE_REGISTRY_OIDC_SCOPES
+#  COMANAGE_REGISTRY_OIDC_SESSION_INACTIVITY_TIMEOUT
+#  COMANAGE_REGISTRY_OIDC_SESSION_MAX_DURATION
+#  COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN
+# Arguments:
+#   Path to file
+# Returns:
+#   None
+##########################################
+function comanage_utils::virtual_host_authentication() {
+        local a2query_out
+        local mod_auth_openidc
+        local shib
+        local virtual_host_config
+
+        virtual_host_config="$1"
+
+        mod_auth_openidc=0
+        shib=0
+
+        # Test for mod_auth_openidc module.
+        (a2query -m auth_openidc) > /dev/null 2>&1
+        a2query_out=$?
+        if [[ $a2query_out -eq 0 ]]; then
+            mod_auth_openidc=1
+        fi
+
+        # Test for shib2 module.
+        (a2query -m shib2) > /dev/null 2>&1
+        a2query_out=$?
+        if [[ $a2query_out -eq 0 ]]; then
+            shib=1
+        fi
+
+        # Write mod_auth_openidc if module enabled.
+        if [[ $mod_auth_openidc -eq 1 ]]; then
+            cat >> $virtual_host_config <<EOF
+
+OIDCProviderMetadataURL ${COMANAGE_REGISTRY_OIDC_PROVIDER_METADATA_URL}
+OIDCRemoteUserClaim ${COMANAGE_REGISTRY_OIDC_REMOTE_USER_CLAIM:-sub}
+
+OIDCClientID ${COMANAGE_REGISTRY_OIDC_CLIENT_ID}
+OIDCClientSecret ${COMANAGE_REGISTRY_OIDC_CLIENT_SECRET}
+
+OIDCScope "${COMANAGE_REGISTRY_OIDC_SCOPES:-openid}"
+OIDCCryptoPassphrase ${COMANAGE_REGISTRY_OIDC_CRYPTO_PASSPHRASE}
+
+OIDCRedirectURI https://${COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN}/secure/redirect
+
+OIDCSessionInactivityTimeout ${COMANAGE_REGISTRY_OIDC_SESSION_INACTIVITY_TIMEOUT:-3600}
+OIDCSessionMaxDuration ${COMANAGE_REGISTRY_OIDC_SESSION_MAX_DURATION:-3600}
+EOF
+
+            if [[ -n "${COMANAGE_REGISTRY_OIDC_FORWARD_HEADERS}" ]]; then
+                cat >> $virtual_host_config <<EOF
+OIDCXForwardedHeaders X-Forwarded-Host X-Forwarded-Port X-Forwarded-Proto
+EOF
+            fi
+
+            if [[ -n "${COMANAGE_REGISTRY_OIDC_AUTH_REQUEST_PARAMS}" ]]; then
+                cat >> $virtual_host_config <<EOF
+OIDCAuthRequestParams ${COMANAGE_REGISTRY_OIDC_AUTH_REQUEST_PARAMS}
+EOF
+            fi
+
+            cat >> $virtual_host_config <<EOF
+
+<Location /secure/redirect>
+  AuthType openid-connect
+  Require valid-user
+</Location>
+
+<Directory /var/www/html/registry>
+Options Indexes FollowSymLinks
+DirectoryIndex index.php
+AllowOverride All
+AuthType openid-connect
+OIDCUnAuthAction pass
+Require valid-user
+</Directory>
+
+<Directory /var/www/html/registry/auth/login>
+AuthType openid-connect
+OIDCUnAuthAction auth
+Require valid-user
+</Directory>
+
+RewriteEngine On
+RewriteCond %{QUERY_STRING} !after_redirect
+RewriteRule ^/registry/auth/logout.* https://%{HTTP_HOST}/secure/redirect?logout=https://%{HTTP_HOST}/registry/auth/logout/?after_redirect [L,R]
+EOF
+
+        # Write shib if module enabled.
+        elif [[ $shib -eq 1 ]]; then
+            cat >> $virtual_host_config <<EOF
+
+<Location "/Shibboleth.sso">
+SetHandler shib
+</Location>
+
+<Directory /var/www/html/registry/auth/login>
+AuthType shibboleth
+ShibRequestSetting requireSession 1
+Require valid-user
+</Directory>
+
+<Location />
+AuthType shibboleth
+Require shibboleth
+</Location>
+
+RewriteEngine On
+RewriteCond %{QUERY_STRING} !after_redirect
+RewriteRule ^/registry/auth/logout.* https://%{HTTP_HOST}/Shibboleth.sso/Logout?return=https://%{HTTP_HOST}/registry/auth/logout/?after_redirect [L,R]
+EOF
+
+        # Else assume basic authentication.
+        else
+            cat >> $virtual_host_config <<EOF
+
+<Directory /var/www/html/registry/auth/login>
+AuthType Basic
+AuthName "COmanage Registry Login"
+AuthBasicProvider file
+AuthUserFile "/etc/apache2/basic-auth"
+Require valid-user
+</Directory>
+EOF
+        fi
+}
+
+##########################################
+# Write virtual host closing stanza
+# Globals:
+# Arguments:
+#   Path to file
+# Returns:
+#   None
+##########################################
+function comanage_utils::virtual_host_close() {
+        local virtual_host_config
+
+        virtual_host_config="$1"
+
+        cat >> $virtual_host_config <<EOF
+
+</VirtualHost>
+EOF
+}
+
+##########################################
+# Write virtual host general configuration
+# Globals:
+# Arguments:
+#   Path to file
+# Returns:
+#   None
+##########################################
+function comanage_utils::virtual_host_general_config() {
+
+        local virtual_host_config
+        virtual_host_config="$1"
+
+        cat >> $virtual_host_config <<"EOF"
+DocumentRoot /var/www/html
+
+RedirectMatch ^/$ /registry/
+
+LogFormat "%a %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
+LogLevel warn
+ErrorLog ${APACHE_LOG_DIR}/error.log
+CustomLog ${APACHE_LOG_DIR}/access.log combined
+
+<Directory /var/www/html/registry>
+Options Indexes FollowSymLinks
+DirectoryIndex index.php
+AllowOverride All
+Require all granted
+</Directory>
+EOF
+
+}
+
+##########################################
+# Write virtual host HTTP opening stanza
+# Globals:
+#  COMANAGE_REGISTRY_HTTP_LISTEN_PORT
+#  COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN
+#  COMANAGE_REGISTRY_VIRTUAL_HOST_PORT
+#  COMANAGE_REGISTRY_VIRTUAL_HOST_SCHEME
+# Arguments:
+#   Path to file
+# Returns:
+#   None
+##########################################
+function comanage_utils::virtual_host_http_opening() {
+
+        local virtual_host_config
+        virtual_host_config="$1"
+
+        cat >> $virtual_host_config <<EOF
+<VirtualHost *:${COMANAGE_REGISTRY_HTTP_LISTEN_PORT:-80}>
+ServerName ${COMANAGE_REGISTRY_VIRTUAL_HOST_SCHEME:-http}://${COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN}:${COMANAGE_REGISTRY_VIRTUAL_HOST_PORT:-80}
+UseCanonicalName On
+UseCanonicalPhysicalPort On
+
+EOF
+}
+
+##########################################
+# Write virtual host HTTPS opening stanza
+# Globals:
+#  COMANAGE_REGISTRY_VIRTUAL_HOST_SCHEME
+#  COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN
+#  COMANAGE_REGISTRY_VIRTUAL_HOST_PORT
+#  COMANAGE_REGISTRY_HTTPS_LISTEN_PORT
+# Arguments:
+#   Path to file
+# Returns:
+#   None
+##########################################
+function comanage_utils::virtual_host_https_opening() {
+
+        local virtual_host_config
+        virtual_host_config="$1"
+
+        cat >> $virtual_host_config <<EOF
+<VirtualHost *:${COMANAGE_REGISTRY_HTTPS_LISTEN_PORT:-443}>
+ServerName ${COMANAGE_REGISTRY_VIRTUAL_HOST_SCHEME:-https}://${COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN}:${COMANAGE_REGISTRY_VIRTUAL_HOST_PORT:-443}
+UseCanonicalName On
+UseCanonicalPhysicalPort On
+
+Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
+
+SSLEngine on
+SSLProtocol all -SSLv2 -SSLv3
+SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
+SSLHonorCipherOrder on
+
+SSLCertificateFile /etc/apache2/cert.pem
+SSLCertificateKeyFile /etc/apache2/privkey.pem
+EOF
+
+}
+
+##########################################
+# Write virtual host HTTP redirect stanza
+# Globals:
+# Arguments:
+#   Path to file
+# Returns:
+#   None
+##########################################
+function comanage_utils::virtual_host_http_redirect() {
+
+        local virtual_host_config
+        virtual_host_config="$1"
+
+        cat >> $virtual_host_config <<"EOF"
+RewriteEngine On
+RewriteCond %{HTTPS} off
+RewriteRule ^ https://%{HTTP_HOST}:443%{REQUEST_URI} [R=302,L,QSA]
+EOF
+
+}
+
+
+##########################################
+# Wait until able to connect to database
+# Globals:
+#   COMANAGE_REGISTRY_DIR
+#   OUTPUT
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::wait_database_connectivity() {
+
+    pushd "$COMANAGE_REGISTRY_DIR/app" > "$OUTPUT" 2>&1
+
+    # Loop until we are able to open a connection to the database.
+    echo "Testing database availability..." > "$OUTPUT"
+    until ./bin/cake test -t database > "$OUTPUT" 2>&1; do
+        >&2 echo "Database is unavailable - sleeping"
+        sleep 1
+    done
+
+    echo "Database is available" > "$OUTPUT"
+
+    popd > "$OUTPUT" 2>&1
+}
diff --git a/container/registry/base/docker-comanage-entrypoint b/container/registry/base/docker-comanage-entrypoint
new file mode 100755
index 000000000..3ffc2331d
--- /dev/null
+++ b/container/registry/base/docker-comanage-entrypoint
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# COmanage Registry Dockerfile entrypoint
+#
+# Portions licensed to the University Corporation for Advanced Internet
+# Development, Inc. ("UCAID") under one or more contributor license agreements.
+# See the NOTICE file distributed with this work for additional information
+# regarding copyright ownership.
+#
+# UCAID licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+source /usr/local/lib/comanage_utils.sh
+
+comanage_utils::exec_apache_http_server "$@"
diff --git a/container/registry/basic-auth/Dockerfile b/container/registry/basic-auth/Dockerfile
new file mode 100644
index 000000000..ce858f0a3
--- /dev/null
+++ b/container/registry/basic-auth/Dockerfile
@@ -0,0 +1,27 @@
+# COmanage Registry Dockerfile template
+#
+# Portions licensed to the University Corporation for Advanced Internet
+# Development, Inc. ("UCAID") under one or more contributor license agreements.
+# See the NOTICE file distributed with this work for additional information
+# regarding copyright ownership.
+#
+# UCAID licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+ARG COMANAGE_REGISTRY_VERSION=develop
+ARG COMANAGE_REGISTRY_BASE_IMAGE_VERSION=1
+FROM comanage-registry-base:${COMANAGE_REGISTRY_VERSION}-${COMANAGE_REGISTRY_BASE_IMAGE_VERSION}
+
+ARG COMANAGE_REGISTRY_BASE_IMAGE_VERSION
+ENV COMANAGE_REGISTRY_BASE_IMAGE_VERSION ${COMANAGE_REGISTRY_BASE_IMAGE_VERSION}
+LABEL comanage_registry_base_image_version=${COMANAGE_REGISTRY_BASE_IMAGE_VERSION}
+
+COPY container/registry/basic-auth/basic-auth /etc/apache2/
diff --git a/container/registry/basic-auth/basic-auth b/container/registry/basic-auth/basic-auth
new file mode 100644
index 000000000..250651ea0
--- /dev/null
+++ b/container/registry/basic-auth/basic-auth
@@ -0,0 +1 @@
+registry.admin:$apr1$qqrvav7G$nSHYErU4ljDPmO1wNBG6e0
diff --git a/container/registry/mod_auth_openidc/Dockerfile b/container/registry/mod_auth_openidc/Dockerfile
new file mode 100644
index 000000000..ba675ac1e
--- /dev/null
+++ b/container/registry/mod_auth_openidc/Dockerfile
@@ -0,0 +1,73 @@
+# COmanage Registry Dockerfile template
+#
+# Portions licensed to the University Corporation for Advanced Internet
+# Development, Inc. ("UCAID") under one or more contributor license agreements.
+# See the NOTICE file distributed with this work for additional information
+# regarding copyright ownership.
+#
+# UCAID licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+ARG COMANAGE_REGISTRY_VERSION=develop
+ARG COMANAGE_REGISTRY_BASE_IMAGE_VERSION=1
+ARG MOD_AUTH_OPENIDC_VERSION
+
+FROM comanage-registry-base:${COMANAGE_REGISTRY_VERSION}-${COMANAGE_REGISTRY_BASE_IMAGE_VERSION} AS comanage
+
+FROM debian:11-slim AS building
+
+ARG MOD_AUTH_OPENIDC_VERSION
+ENV MOD_AUTH_OPENIDC_VERSION ${MOD_AUTH_OPENIDC_VERSION:-2.4.12.2}
+
+RUN apt-get update \
+      && apt-get install -y --no-install-recommends \
+        apache2 \
+        apache2-dev \
+        automake \
+        ca-certificates \
+        libcjose0 \
+        libcjose-dev \
+        libcurl4-openssl-dev \
+        libjansson-dev \
+        libpcre3-dev \
+        libssl-dev \
+        pkg-config \
+        wget 
+
+RUN MOD_AUTH_OPENIDC_URL="https://github.com/zmartzone/mod_auth_openidc/releases/download/v${MOD_AUTH_OPENIDC_VERSION}/mod_auth_openidc-${MOD_AUTH_OPENIDC_VERSION}.tar.gz" \
+      && mkdir -p /tmp/mod_auth_openidc \
+      && wget -O mod_auth_openidc.tar.gz "${MOD_AUTH_OPENIDC_URL}" \
+      && tar -zxf mod_auth_openidc.tar.gz -C /tmp/mod_auth_openidc --strip-components=1 \
+      && cd /tmp/mod_auth_openidc \
+      && ./configure --with-apxs2=`which apxs2` \
+      && make \
+      && make install 
+
+FROM comanage
+
+ARG COMANAGE_REGISTRY_BASE_IMAGE_VERSION
+ENV COMANAGE_REGISTRY_BASE_IMAGE_VERSION ${COMANAGE_REGISTRY_BASE_IMAGE_VERSION}
+LABEL comanage_registry_base_image_version=${COMANAGE_REGISTRY_BASE_IMAGE_VERSION}
+
+ARG MOD_AUTH_OPENIDC_VERSION
+ENV MOD_AUTH_OPENIDC_VERSION ${MOD_AUTH_OPENIDC_VERSION:-2.4.10}
+LABEL mod_auth_openidc_version ${MOD_AUTH_OPENIDC_VERSION}
+
+RUN apt-get update \
+        && apt-get install -y --no-install-recommends \
+          libcjose0
+
+COPY --from=building /usr/lib/apache2/modules/mod_auth_openidc.so /usr/lib/apache2/modules/mod_auth_openidc.so
+
+RUN echo "LoadModule auth_openidc_module /usr/lib/apache2/modules/mod_auth_openidc.so" > /etc/apache2/mods-available/auth_openidc.load \
+      && a2enmod auth_openidc 
+
+COPY container/registry/mod_auth_openidc/htaccess /srv/comanage-registry/app/webroot/.htaccess
diff --git a/container/registry/mod_auth_openidc/htaccess b/container/registry/mod_auth_openidc/htaccess
new file mode 100644
index 000000000..7c9b5d9b3
--- /dev/null
+++ b/container/registry/mod_auth_openidc/htaccess
@@ -0,0 +1,11 @@
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteCond %{REQUEST_FILENAME} !-d
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteRule ^(.*)$ index.php?/$1 [QSA,L]
+
+    RewriteRule .* - [E=REDIRECT_OIDC_CLAIM_NAME_GIVEN:%{HTTP:OIDC_CLAIM_given_name}]
+    RewriteRule .* - [E=REDIRECT_OIDC_CLAIM_NAME_FAMILY:%{HTTP:OIDC_CLAIM_family_name}]
+    RewriteRule .* - [E=REDIRECT_OIDC_CLAIM_NAME_MIDDLE:%{HTTP:OIDC_CLAIM_middle_name}]
+
+</IfModule>
diff --git a/container/registry/shibboleth-sp-supervisor/Dockerfile b/container/registry/shibboleth-sp-supervisor/Dockerfile
new file mode 100644
index 000000000..c998c8221
--- /dev/null
+++ b/container/registry/shibboleth-sp-supervisor/Dockerfile
@@ -0,0 +1,64 @@
+# COmanage Registry Dockerfile
+#
+# Portions licensed to the University Corporation for Advanced Internet
+# Development, Inc. ("UCAID") under one or more contributor license agreements.
+# See the NOTICE file distributed with this work for additional information
+# regarding copyright ownership.
+#
+# UCAID licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+ARG COMANAGE_REGISTRY_VERSION=develop
+ARG COMANAGE_REGISTRY_BASE_IMAGE_VERSION=1
+ARG COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION="3.4.1"
+ARG COMANAGE_REGISTRY_SHIBBOLETH_SP_BASE_IMAGE_VERSION=1
+
+FROM comanage-registry-shibboleth-sp-base:${COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION}-${COMANAGE_REGISTRY_SHIBBOLETH_SP_BASE_IMAGE_VERSION} AS shib-base
+
+FROM comanage-registry-base:${COMANAGE_REGISTRY_VERSION}-${COMANAGE_REGISTRY_BASE_IMAGE_VERSION} AS comanage
+
+ARG COMANAGE_REGISTRY_BASE_IMAGE_VERSION
+ENV COMANAGE_REGISTRY_BASE_IMAGE_VERSION ${COMANAGE_REGISTRY_BASE_IMAGE_VERSION}
+LABEL comanage_registry_base_image_version=${COMANAGE_REGISTRY_BASE_IMAGE_VERSION}
+
+ARG COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION
+ENV COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION ${COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION}
+LABEL comanage_registry_shibboleth_sp_version=${COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION}
+
+ARG COMANAGE_REGISTRY_SHIBBOLETH_SP_BASE_IMAGE_VERSION
+ENV COMANAGE_REGISTRY_SHIBBOLETH_SP_BASE_IMAGE_VERSION ${COMANAGE_REGISTRY_SHIBBOLETH_SP_BASE_IMAGE_VERSION}
+LABEL comanage_registry_shibboleth_sp_base_image_version ${COMANAGE_REGISTRY_SHIBBOLETH_SP_BASE_IMAGE_VERSION}
+
+RUN apt-get install -y --no-install-recommends supervisor \
+      && mkdir -p /var/log/supervisor
+
+COPY --from=shib-base /opt/shibboleth-sp /opt/shibboleth-sp/
+COPY --from=shib-base /opt/shibboleth-sp/etc/shibboleth/shib2.load /etc/apache2/mods-available/
+
+RUN /usr/sbin/useradd --system _shibd \
+      && mkdir -p /var/run/shibboleth \
+      && chown _shibd:_shibd /var/run/shibboleth \
+      && chown -R _shibd:_shibd /opt/shibboleth-sp/var \
+      && cp -a /opt/shibboleth-sp/etc/shibboleth /etc/shibboleth \
+      && rm -f /etc/shibboleth/shibboleth2.xml \
+      && chown _shibd:_shibd /etc/shibboleth/sp-signing-cert.pem \
+      && chown _shibd:_shibd /etc/shibboleth/sp-signing-key.pem \
+      && chown _shibd:_shibd /etc/shibboleth/sp-encrypt-cert.pem \
+      && chown _shibd:_shibd /etc/shibboleth/sp-encrypt-key.pem \
+      && cd /opt/shibboleth-sp/etc \
+      && rm -rf shibboleth \
+      && ln -s /etc/shibboleth shibboleth \
+      && a2enmod shib2
+
+COPY container/registry/shibboleth-sp-supervisor/supervisord.conf /usr/local/etc/supervisord.conf
+COPY container/registry/shibboleth-sp-supervisor/docker-comanage-shibboleth-sp-entrypoint /usr/local/bin/
+
+ENTRYPOINT ["/usr/bin/supervisord", "-c", "/usr/local/etc/supervisord.conf"]
diff --git a/container/registry/shibboleth-sp-supervisor/docker-comanage-shibboleth-sp-entrypoint b/container/registry/shibboleth-sp-supervisor/docker-comanage-shibboleth-sp-entrypoint
new file mode 100755
index 000000000..28dc7b63b
--- /dev/null
+++ b/container/registry/shibboleth-sp-supervisor/docker-comanage-shibboleth-sp-entrypoint
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# COmanage Registry Shibboleth SP Dockerfile entrypoint
+#
+# Portions licensed to the University Corporation for Advanced Internet
+# Development, Inc. ("UCAID") under one or more contributor license agreements.
+# See the NOTICE file distributed with this work for additional information
+# regarding copyright ownership.
+#
+# UCAID licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+source /usr/local/lib/comanage_shibboleth_sp_utils.sh
+
+comanage_shibboleth_sp_utils::exec_shibboleth_sp_daemon
diff --git a/container/registry/shibboleth-sp-supervisor/supervisord.conf b/container/registry/shibboleth-sp-supervisor/supervisord.conf
new file mode 100644
index 000000000..8b3e8e3bb
--- /dev/null
+++ b/container/registry/shibboleth-sp-supervisor/supervisord.conf
@@ -0,0 +1,36 @@
+; COmanage Registry Docker supervisord configuration
+; 
+; Portions licensed to the University Corporation for Advanced Internet
+; Development, Inc. ("UCAID") under one or more contributor license agreements.
+; See the NOTICE file distributed with this work for additional information
+; regarding copyright ownership.
+; 
+; UCAID licenses this file to you under the Apache License, Version 2.0
+; (the "License"); you may not use this file except in compliance with the
+; License. You may obtain a copy of the License at:
+; 
+; http://www.apache.org/licenses/LICENSE-2.0
+; 
+; Unless required by applicable law or agreed to in writing, software
+; distributed under the License is distributed on an "AS IS" BASIS,
+; WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+; See the License for the specific language governing permissions and
+; limitations under the License.
+
+[supervisord]
+nodaemon=true
+user=root
+
+[program:apache2]
+command=/usr/local/bin/docker-comanage-entrypoint apache2-foreground
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:shibd]
+command=/usr/local/bin/docker-comanage-shibboleth-sp-entrypoint
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
diff --git a/container/shibboleth-sp-base/Dockerfile b/container/shibboleth-sp-base/Dockerfile
new file mode 100644
index 000000000..361f18ba4
--- /dev/null
+++ b/container/shibboleth-sp-base/Dockerfile
@@ -0,0 +1,188 @@
+# Dockerfile for Shibboleth SP for COmanage Registry
+#
+# Portions licensed to the University Corporation for Advanced Internet
+# Development, Inc. ("UCAID") under one or more contributor license agreements.
+# See the NOTICE file distributed with this work for additional information
+# regarding copyright ownership.
+#
+# UCAID licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+FROM debian:11-slim
+
+ARG LOG4SHIB_VERSION
+ENV LOG4SHIB_VERSION=${LOG4SHIB_VERSION:-2.0.1}
+
+ARG XERCESC_VERSION
+ENV XERCESC_VERSION=${XERCESC_VERSION:-3.2.4}
+
+ARG XMLSECC_VERSION
+ENV XMLSECC_VERSION=${XMLSECC_VERSION:-2.0.4}
+
+ARG XMLTOOLING_VERSION
+ENV XMLTOOLING_VERSION=${XMLTOOLING_VERSION:-3.2.2}
+
+ARG OPENSAMLC_VERSION
+ENV OPENSAMLC_VERSION=${OPENSAMLC_VERSION:-3.2.1}
+
+ARG SHIBBOLETH_SP_VERSION
+ENV SHIBBOLETH_SP_VERSION=${SHIBBOLETH_SP_VERSION:-3.4.1}
+
+RUN apt-get update \
+      && apt-get install -y --no-install-recommends \
+            apache2 \
+            apache2-dev \
+            ca-certificates \
+            file \
+            gcc \
+            g++ \
+            libboost-dev \
+            libcurl4-openssl-dev \
+            libssl-dev \
+            libssl1.1 \
+            make \
+            pkg-config \
+            wget \
+            zlib1g-dev
+
+
+RUN LOG4SHIB_URL="https://shibboleth.net/downloads/log4shib/${LOG4SHIB_VERSION}/log4shib-${LOG4SHIB_VERSION}.tar.gz" \
+      && wget -O log4shib.tar.gz "${LOG4SHIB_URL}" \
+      && mkdir -p src \
+      && tar -zxf log4shib.tar.gz -C src --strip-components=1 \
+      && rm -f log4shib.tar.gz \
+      && cd src \
+      && LD_FLAGS=-lpthread CXXFLAGS="-fPIC" ./configure --disable-static \
+            --disable-doxygen \ 
+            --prefix=/opt/shibboleth-sp \
+            --build=x86_64 \
+      && LD_FLAGS=-lpthread make \
+      && make -j 2 install \
+      && cd .. \
+      && rm -r src 
+
+RUN XERCESC_DIST_URLS="\
+    https://mirrors.ocf.berkeley.edu/apache/xerces/c/3/sources/xerces-c-${XERCESC_VERSION}.tar.gz \
+    http://www.gtlib.gatech.edu/pub/apache//xerces/c/3/sources/xerces-c-${XERCESC_VERSION}.tar.gz \
+    http://apache.mirrors.spacedump.net/xerces/c/3/sources/xerces-c-${XERCESC_VERSION}.tar.gz \
+    http://apache.mirror.serversaustralia.com.au/xerces/c/3/sources/xerces-c-${XERCESC_VERSION}.tar.gz" \
+    && for distUrl in ${XERCESC_DIST_URLS}; \
+      do \
+        if wget -nv -O xerces.tar.gz "${distUrl}"; then \
+            break; \
+        fi; \
+      done \
+      && mkdir -p src \
+      && tar -zxf xerces.tar.gz -C src --strip-components=1 \
+      && rm -f xerces.tar.gz \
+      && cd src \
+      && ./configure --prefix=/opt/shibboleth-sp \
+      && make -j 2 \
+      && make install \
+      && cd .. \
+      && rm -r src 
+
+RUN XMLSECC_DIST_URLS="\
+    https://mirrors.ocf.berkeley.edu/apache/santuario/c-library/xml-security-c-${XMLSECC_VERSION}.tar.gz \
+    https://mirrors.ocf.berkeley.edu/apache/santuario/c-library/xml-security-c-${XMLSECC_VERSION}.tar.gz \
+    http://www.gtlib.gatech.edu/pub/apache/santuario/c-library/xml-security-c-${XMLSECC_VERSION}.tar.gz \
+    http://apache.mirrors.spacedump.net/santuario/c-library/xml-security-c-${XMLSECC_VERSION}.tar.gz \
+    http://apache.mirror.serversaustralia.com.au/santuario/c-library/xml-security-c-${XMLSECC_VERSION}.tar.gz" \
+    && for distUrl in ${XMLSECC_DIST_URLS}; \
+      do \
+        if wget -nv -O xmlsecc.tar.gz "${distUrl}"; then \
+            break; \
+        fi; \
+      done \
+      && mkdir -p src \
+      && tar -zxf xmlsecc.tar.gz -C src --strip-components=1 \
+      && rm -f xmlsecc.tar.gz \
+      && cd src \
+      && PKG_CONFIG_PATH=/opt/shibboleth-sp/lib/pkgconfig ./configure --prefix=/opt/shibboleth-sp \
+            --with-openssl=/usr \
+            --disable-static \
+            --without-xalan \
+      && make -j 2 \
+      && make install \
+      && cd .. \
+      && rm -r src 
+
+RUN XMLTOOLING_URL="https://shibboleth.net/downloads/c++-opensaml/${OPENSAMLC_VERSION}/xmltooling-${XMLTOOLING_VERSION}.tar.gz" \
+      && wget -O xmltooling.tar.gz "${XMLTOOLING_URL}" \
+      && mkdir -p src \
+      && tar -zxf xmltooling.tar.gz -C src --strip-components=1 \
+      && rm -f xmltooling.tar.gz \
+      && cd src \
+      && CXXFLAGS="-fPIC" \
+            PKG_CONFIG_PATH=/opt/shibboleth-sp/lib/pkgconfig \
+            ./configure --prefix=/opt/shibboleth-sp \
+            --with-log4shib=/opt/shibboleth-sp \
+            -C \
+      && make -j 2 \
+      && make install \
+      && cd .. \
+      && rm -r src 
+
+RUN OPENSAMLC_URL="https://shibboleth.net/downloads/c++-opensaml/${OPENSAMLC_VERSION}/opensaml-${OPENSAMLC_VERSION}.tar.gz" \
+      && wget -O opensamlc.tar.gz "${OPENSAMLC_URL}" \
+      && mkdir -p src \
+      && tar -zxf opensamlc.tar.gz -C src --strip-components=1 \
+      && rm -f opensamlc.tar.gz \
+      && cd src \
+      && PKG_CONFIG_PATH=/opt/shibboleth-sp/lib/pkgconfig \
+            ./configure --prefix=/opt/shibboleth-sp \
+            --with-log4shib=/opt/shibboleth-sp \
+            -C \
+      && make -j 2 \
+      && make install \
+      && cd .. \
+      && rm -r src 
+
+RUN SHIBBOLETH_SP_URL="https://shibboleth.net/downloads/service-provider/${SHIBBOLETH_SP_VERSION}/shibboleth-sp-${SHIBBOLETH_SP_VERSION}.tar.gz" \
+      && wget -O shibboleth-sp.tar.gz "${SHIBBOLETH_SP_URL}" \
+      && mkdir -p src \
+      && tar -zxf shibboleth-sp.tar.gz -C src --strip-components=1 \
+      && rm -f shibboleth-sp.tar.gz \
+      && cd src \
+      && CXXFLAGS="-Wno-unused-parameter" \
+            PKG_CONFIG_PATH=/opt/shibboleth-sp/lib/pkgconfig \
+            ./configure --prefix=/opt/shibboleth-sp \
+            --with-log4shib=/opt/shibboleth-sp \
+            --with-saml=/opt/shibboleth-sp \
+            --with-xerces=/opt/shibboleth-sp \
+            --with-xmlsec=/opt/shibboleth-sp \
+            --with-xmltooling=/opt/shibboleth-sp \
+            --enable-apache-24 \
+            --with-apxs24=/usr/bin/apxs \
+            --disable-adfs \
+            --disable-obc \
+      && make -j 2 \
+      && make install \
+      && cd .. \
+      && rm -r src 
+
+COPY container/shibboleth-sp-base/shib2.load /opt/shibboleth-sp/etc/shibboleth/shib2.load
+COPY container/shibboleth-sp-base/shibboleth2.xml.template /opt/shibboleth-sp/etc/shibboleth/shibboleth2.xml.template
+COPY container/shibboleth-sp-base/shibd.logger /opt/shibboleth-sp/etc/shibboleth/shibd.logger
+COPY container/shibboleth-sp-base/native.logger /opt/shibboleth-sp/etc/shibboleth/native.logger
+COPY container/shibboleth-sp-base/console.logger /opt/shibboleth-sp/etc/shibboleth/console.logger
+
+RUN apt-get purge -y \
+         apache2-dev \
+         file \
+         gcc \
+         g++ \
+         libboost-dev \
+         libcurl4-openssl-dev \
+         libssl-dev \
+         make \
+         pkg-config \
+      && apt-get clean
diff --git a/container/shibboleth-sp-base/console.logger b/container/shibboleth-sp-base/console.logger
new file mode 100644
index 000000000..fb256f182
--- /dev/null
+++ b/container/shibboleth-sp-base/console.logger
@@ -0,0 +1,32 @@
+log4j.rootCategory=WARN, console
+
+# fairly verbose for DEBUG, so generally leave at INFO
+log4j.category.XMLTooling.XMLObject=INFO
+log4j.category.XMLTooling.KeyInfoResolver=INFO
+log4j.category.Shibboleth.IPRange=INFO
+log4j.category.Shibboleth.PropertySet=INFO
+
+# raise for low-level tracing of SOAP client HTTP/SSL behavior
+log4j.category.XMLTooling.libcurl=INFO
+
+# useful categories to tune independently:
+#
+# tracing of SAML messages and security policies
+#log4j.category.OpenSAML.MessageDecoder=DEBUG
+#log4j.category.OpenSAML.MessageEncoder=DEBUG
+#log4j.category.OpenSAML.SecurityPolicyRule=DEBUG
+# interprocess message remoting
+#log4j.category.Shibboleth.Listener=DEBUG
+# mapping of requests to applicationId
+#log4j.category.Shibboleth.RequestMapper=DEBUG
+# high level session cache operations
+#log4j.category.Shibboleth.SessionCache=DEBUG
+# persistent storage and caching
+#log4j.category.XMLTooling.StorageService=DEBUG
+
+# define the appender
+
+log4j.appender.console=org.apache.log4j.ConsoleAppender
+#log4j.appender.console.layout=org.apache.log4j.BasicLayout
+log4j.appender.console.layout=org.apache.log4j.PatternLayout
+log4j.appender.console.layout.ConversionPattern=console_log %d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n
diff --git a/container/shibboleth-sp-base/native.logger b/container/shibboleth-sp-base/native.logger
new file mode 100644
index 000000000..3858c443f
--- /dev/null
+++ b/container/shibboleth-sp-base/native.logger
@@ -0,0 +1,31 @@
+# set overall behavior
+log4j.rootCategory=INFO, native_log
+
+# fairly verbose for DEBUG, so generally leave at WARN/INFO
+log4j.category.XMLTooling.XMLObject=WARN
+log4j.category.XMLTooling.KeyInfoResolver=WARN
+log4j.category.Shibboleth.IPRange=WARN
+log4j.category.Shibboleth.PropertySet=WARN
+
+# raise for low-level tracing of SOAP client HTTP/SSL behavior
+log4j.category.XMLTooling.libcurl=WARN
+
+# useful categories to tune independently:
+#
+# tracing of SAML messages and security policies
+#log4j.category.OpenSAML.MessageDecoder=DEBUG
+#log4j.category.OpenSAML.MessageEncoder=DEBUG
+#log4j.category.OpenSAML.SecurityPolicyRule=DEBUG
+# interprocess message remoting
+#log4j.category.Shibboleth.Listener=DEBUG
+# mapping of requests to applicationId
+#log4j.category.Shibboleth.RequestMapper=DEBUG
+# high level session cache operations
+#log4j.category.Shibboleth.SessionCache=DEBUG
+# persistent storage and caching
+#log4j.category.XMLTooling.StorageService=DEBUG
+
+# define the appender
+log4j.appender.native_log=org.apache.log4j.ConsoleAppender
+log4j.appender.native_log.layout=org.apache.log4j.PatternLayout
+log4j.appender.native_log.layout.ConversionPattern=native_log %p %c %x: %m%n
diff --git a/container/shibboleth-sp-base/shib2.load b/container/shibboleth-sp-base/shib2.load
new file mode 100644
index 000000000..b518d603f
--- /dev/null
+++ b/container/shibboleth-sp-base/shib2.load
@@ -0,0 +1,20 @@
+# COmanage Registry Apache HTTP Server configuration
+#
+# Portions licensed to the University Corporation for Advanced Internet
+# Development, Inc. ("UCAID") under one or more contributor license agreements.
+# See the NOTICE file distributed with this work for additional information
+# regarding copyright ownership.
+#
+# UCAID licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LoadModule mod_shib /opt/shibboleth-sp/lib/shibboleth/mod_shib_24.so
diff --git a/container/shibboleth-sp-base/shibboleth2.xml.template b/container/shibboleth-sp-base/shibboleth2.xml.template
new file mode 100644
index 000000000..79c1caa90
--- /dev/null
+++ b/container/shibboleth-sp-base/shibboleth2.xml.template
@@ -0,0 +1,55 @@
+<SPConfig 
+    xmlns="urn:mace:shibboleth:3.0:native:sp:config"
+    xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
+    clockSkew="180">
+
+    <OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a" />
+
+    <ApplicationDefaults entityID="%%SHIBBOLETH_SP_ENTITY_ID%%"
+                         REMOTE_USER="eppn subject-id pairwise-id persistent-id"
+                         cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1"
+                         >
+
+        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
+                  checkAddress="false" handlerSSL="true" cookieProps="https" >
+
+           <SSO discoveryProtocol="SAMLDS"
+                discoveryURL="%%SHIBBOLETH_SP_SAMLDS_URL%%" > 
+             SAML2
+           </SSO>
+
+           <Logout>Local</Logout>
+
+           <LogoutInitiator type="Admin" Location="/Logout/Admin" acl="127.0.0.1 ::1" />
+
+            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
+
+            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
+
+            <Handler type="Session" Location="/Session" showAttributeValues="true"/>
+
+            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
+        </Sessions>
+
+        <Errors supportContact="root@localhost"
+            helpLocation="/about.html"
+            styleSheet="/shibboleth-sp/main.css"/>
+        
+        %%SHIBBOLETH_SP_METADATA_PROVIDER_XML%%
+
+        <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
+
+        <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
+
+        <CredentialResolver type="File" use="signing"
+            key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/>
+        <CredentialResolver type="File" use="encryption"
+            key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/>
+
+    </ApplicationDefaults>
+    
+    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
+
+    <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
+
+</SPConfig>
diff --git a/container/shibboleth-sp-base/shibd.logger b/container/shibboleth-sp-base/shibd.logger
new file mode 100644
index 000000000..39f152d6e
--- /dev/null
+++ b/container/shibboleth-sp-base/shibd.logger
@@ -0,0 +1,56 @@
+# set overall behavior
+log4j.rootCategory=INFO, shibd_log
+
+# fairly verbose for DEBUG, so generally leave at INFO
+log4j.category.XMLTooling.XMLObject=INFO
+log4j.category.XMLTooling.KeyInfoResolver=INFO
+log4j.category.Shibboleth.IPRange=INFO
+log4j.category.Shibboleth.PropertySet=INFO
+
+# raise for low-level tracing of SOAP client HTTP/SSL behavior
+log4j.category.XMLTooling.libcurl=INFO
+
+# useful categories to tune independently:
+#
+# tracing of SAML messages and security policies
+#log4j.category.OpenSAML.MessageDecoder=DEBUG
+#log4j.category.OpenSAML.MessageEncoder=DEBUG
+#log4j.category.OpenSAML.SecurityPolicyRule=DEBUG
+#log4j.category.XMLTooling.SOAPClient=DEBUG
+# interprocess message remoting
+#log4j.category.Shibboleth.Listener=DEBUG
+# mapping of requests to applicationId
+#log4j.category.Shibboleth.RequestMapper=DEBUG
+# high level session cache operations
+#log4j.category.Shibboleth.SessionCache=DEBUG
+# persistent storage and caching
+#log4j.category.XMLTooling.StorageService=DEBUG
+
+# logs XML being signed or verified if set to DEBUG
+log4j.category.XMLTooling.Signature.Debugger=INFO, sig_log
+log4j.additivity.XMLTooling.Signature.Debugger=false
+log4j.ownAppenders.XMLTooling.Signature.Debugger=true
+
+# the tran log blocks the "default" appender(s) at runtime
+# Level should be left at INFO for this category
+log4j.category.Shibboleth-TRANSACTION=INFO, tran_log
+log4j.additivity.Shibboleth-TRANSACTION=false
+log4j.ownAppenders.Shibboleth-TRANSACTION=true
+
+# uncomment to suppress particular event types
+#log4j.category.Shibboleth-TRANSACTION.AuthnRequest=WARN
+#log4j.category.Shibboleth-TRANSACTION.Login=WARN
+#log4j.category.Shibboleth-TRANSACTION.Logout=WARN
+
+# define the appenders
+log4j.appender.shibd_log=org.apache.log4j.ConsoleAppender
+log4j.appender.shibd_log.layout=org.apache.log4j.PatternLayout
+log4j.appender.shibd_log.layout.ConversionPattern=shibd_log %d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n
+
+log4j.appender.tran_log=org.apache.log4j.ConsoleAppender
+log4j.appender.tran_log.layout=org.apache.log4j.PatternLayout
+log4j.appender.tran_log.layout.ConversionPattern=tran_log %d{%Y-%m-%d %H:%M:%S}|%c|%m%n
+
+log4j.appender.sig_log=org.apache.log4j.ConsoleAppender
+log4j.appender.sig_log.layout=org.apache.log4j.PatternLayout
+log4j.appender.sig_log.layout.ConversionPattern=sig_log %m