diff --git a/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/shibboleth2.xml b/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/shibboleth2.xml
deleted file mode 100644
index 0c38f82..0000000
--- a/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/shibboleth2.xml
+++ /dev/null
@@ -1,136 +0,0 @@
-<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
-    xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
-    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
-    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"    
-    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
-    clockSkew="180">
-
-    <!--
-    By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
-    are used. See example-shibboleth2.xml for samples of explicitly configuring them.
-    -->
-
-    <!--
-    To customize behavior for specific resources on Apache, and to link vhosts or
-    resources to ApplicationOverride settings below, use web server options/commands.
-    See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements for help.
-    
-    For examples with the RequestMap XML syntax instead, see the example-shibboleth2.xml
-    file, and the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo topic.
-    -->
-    <TCPListener address="127.0.0.1" port="1600"/> 
-
-
-    <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
-    <ApplicationDefaults entityID="https://grouperdemo/shibboleth"
-                         REMOTE_USER="uid">
-
-        <!--
-        Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
-        You MUST supply an effectively unique handlerURL value for each of your applications.
-        The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
-        a relative value based on the virtual host. Using handlerSSL="true", the default, will force
-        the protocol to be https. You should also set cookieProps to "https" for SSL-only sites.
-        Note that while we default checkAddress to "false", this has a negative impact on the
-        security of your site. Stealing sessions via cookie theft is much easier with this disabled.
-        -->
-        <Sessions lifetime="28800" timeout="28800" relayState="ss:mem"
-                  checkAddress="false" handlerSSL="true" cookieProps="https">
-
-            <!--
-            Configures SSO for a default IdP. To allow for >1 IdP, remove
-            entityID property and adjust discoveryURL to point to discovery service.
-            (Set discoveryProtocol to "WAYF" for legacy Shibboleth WAYF support.)
-            You can also override entityID on /Login query string, or in RequestMap/htaccess.
-            -->
-		<SSO entityID="https://idptestbed/idp/shibboleth">
-			SAML2
-		</SSO>
-
-            <!-- SAML and local-only logout. -->
-            <Logout>SAML2 Local</Logout>
-            
-            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
-            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
-
-            <!-- Status reporting service. -->
-            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
-
-            <!-- Session diagnostic service. -->
-            <Handler type="Session" Location="/Session" showAttributeValues="true"/>
-
-            <!-- JSON feed of discovery information. -->
-            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
-        </Sessions>
-
-        <!--
-        Allows overriding of error template information/filenames. You can
-        also add attributes with values that can be plugged into the templates.
-        -->
-        <Errors supportContact="root@localhost"
-            helpLocation="/about.html"
-            styleSheet="/shibboleth-sp/main.css"/>
-        
-        <!-- Example of remotely supplied batch of signed metadata. -->
-        <!--
-        <MetadataProvider type="XML" validate="true"
-	      uri="http://example.org/federation-metadata.xml"
-              backingFilePath="federation-metadata.xml" reloadInterval="7200">
-            <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
-            <MetadataFilter type="Signature" certificate="fedsigner.pem"/>
-            <DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true" 
-              attributeName="http://macedir.org/entity-category"
-              attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
-              attributeValue="http://refeds.org/category/hide-from-discovery" />
-        </MetadataProvider>
-        -->
-
-        <MetadataProvider type="XML" validate="true" file="idp-metadata.xml"/>
-
-        <!--
-        InCommon
-	  <MetadataProvider type="XML" validate="true"
-		uri="http://md.incommon.org/InCommon/InCommon-metadata.xml"
-              backingFilePath="federation-metadata.xml" reloadInterval="7200">
-            <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
-		<MetdataFilter type="Signature" certificate="inc-md-cert.pem"/>
-            <DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true" 
-              attributeName="http://macedir.org/entity-category"
-              attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
-              attributeValue="http://refeds.org/category/hide-from-discovery" />
-        </MetadataProvider>
-        -->
-
-        <!-- Map to extract attributes from SAML assertions. -->
-        <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
-        
-        <!-- Use a SAML query if no attributes are supplied during SSO. -->
-        <AttributeResolver type="Query" subjectMatch="true"/>
-
-        <!-- Default filtering policy for recognized attributes, lets other data pass. -->
-        <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
-
-        <!-- Simple file-based resolver for using a single keypair. -->
-        <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
-
-        <!--
-        The default settings can be overridden by creating ApplicationOverride elements (see
-        the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride topic).
-        Resource requests are mapped by web server commands, or the RequestMapper, to an
-        applicationId setting.
-        
-        Example of a second application (for a second vhost) that has a different entityID.
-        Resources on the vhost would map to an applicationId of "admin":
-        -->
-        <!--
-        <ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/>
-        -->
-    </ApplicationDefaults>
-    
-    <!-- Policies that determine how to process and authenticate runtime messages. -->
-    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
-
-    <!-- Low-level configuration about protocols and bindings available for use. -->
-    <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
-
-</SPConfig>
diff --git a/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/sp-cert.pem b/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/sp-cert.pem
deleted file mode 100644
index 9cc228a..0000000
--- a/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/sp-cert.pem
+++ /dev/null
@@ -1,20 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDPDCCAiQCCQDNZe8r0hVtuTANBgkqhkiG9w0BAQUFADBgMQswCQYDVQQGEwJV
-UzELMAkGA1UECAwCTUkxEjAQBgNVBAcMCUFubiBBcmJvcjEXMBUGA1UECgwOSW50
-ZXJuZXQyL1RJRVIxFzAVBgNVBAMMDnNwLmV4YW1wbGUub3JnMB4XDTE3MDkyMjE5
-NTAzNVoXDTI3MDkyMDE5NTAzNVowYDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk1J
-MRIwEAYDVQQHDAlBbm4gQXJib3IxFzAVBgNVBAoMDkludGVybmV0Mi9USUVSMRcw
-FQYDVQQDDA5zcC5leGFtcGxlLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
-AQoCggEBAMTNJmsNpTpR4NrDJwOgK/o3UYlNdi1c6xBflt+liLAsQc160QReV4dS
-SGK8LZvN58a/BTIsH8dLhQlUQ8qQUY2AfolVrNxb7Waumeh/POzYUTRylnoGpU3W
-bGMEPxE/AdgP5U/adYvyu4XI5epv7wjZJOTqcVag15SalY+aso+ZC/5l+UzRxmWB
-ZxKTsSL1y7PFehY4/Zl3Y3oGVsVl/zspt5lteoZQeeVxUX29S3Af11yHY4xpEp+7
-rvAzY/nlsTiHAsUoCFK/NFQ2evvSRx52B9Fk1cWP1MDVDm2QjQqD9xBGYSnX6bhQ
-ejVx7JUJHlblu2Q5p5XdW0BihgFluoECAwEAATANBgkqhkiG9w0BAQUFAAOCAQEA
-n/qhYnIviPs4tglCdrw+M7gbqKNWadDC3F9HDYzlJMFeS/ae2turhEUgQPbYPDQQ
-eO3oOILtvCXNFUPM58jf8V5YFRrOqrTgx44kexQDaHO5YYNft5tF5TdvBYE2gOVr
-GdYrH2iSP8WX+Yy7JH5uqkfwWzEntWHJdey39rCWKAUCCB35+/2b4N53Qmlv2+ug
-CpNJYFtXInd4YMmM5HjXLyoWXtjnKiwDqYUCeYPSwAajnCqRqRXUX0gYTFDRiwRP
-HbmO9We0nqoc/71nikmGGoSRMO/zWVMFjwmAx1fGiWdU61sjGX8sHifzmVyJVEBI
-Z75p+JrWYZJYrx/vpWxL8g==
------END CERTIFICATE-----
diff --git a/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/sp-key.pem b/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/sp-key.pem
deleted file mode 100644
index 1b0b579..0000000
--- a/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/sp-key.pem
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDEzSZrDaU6UeDa
-wycDoCv6N1GJTXYtXOsQX5bfpYiwLEHNetEEXleHUkhivC2bzefGvwUyLB/HS4UJ
-VEPKkFGNgH6JVazcW+1mrpnofzzs2FE0cpZ6BqVN1mxjBD8RPwHYD+VP2nWL8ruF
-yOXqb+8I2STk6nFWoNeUmpWPmrKPmQv+ZflM0cZlgWcSk7Ei9cuzxXoWOP2Zd2N6
-BlbFZf87KbeZbXqGUHnlcVF9vUtwH9dch2OMaRKfu67wM2P55bE4hwLFKAhSvzRU
-Nnr70kcedgfRZNXFj9TA1Q5tkI0Kg/cQRmEp1+m4UHo1ceyVCR5W5btkOaeV3VtA
-YoYBZbqBAgMBAAECggEAA/5t0ypZug9DUu0283niqpdIzlKGHXGPS6vE8hD37ytW
-wobFiyMm/5YJ5gcPnePV2lCyGEyQ8Ih10LSnE4tOPGLpLnxQn8A11ymf8fnzEJNr
-Qnc42o0b+bJqTLAfX4g5z1qzOqWiUQ7CA3sKP3G6FiHh/8tKNYnaFif09Q8cpJFb
-YDDkvm48NJgsrIoCgmaFIQIn+yDzGQKWwTNMIks+RByWpc67j1x1kiyQM1RfrEev
-Yyq/ZkP66IYZzmZKpFCWGs5qbRZdxyXNpq85DjwA99lAH7vxtMJHQM4z1h1eDH4L
-Ma5hEnmmHu4D5lF2GDQYflvuFdDGH5tThO6MV0IrSQKBgQD+kvEtNxJCMxLOVFyV
-NWF3pk/i2nkD+53t/VPXjMPtW7IesouEGzU82I/fT2wUTkNwFdkVpv37qoLypKZm
-npJFxr6abQNjiDh2Fsh8/iuJfvdZUFJbCEY6NS58qgjix8XCQKRD06EugK7uekIZ
-zJnttF3qVBBD8Z8Uwxz8i+jF1wKBgQDF51y/5XB6Bz47cdxw7P8NsfnTz2V3H0HU
-OnlEBANbhmBadjU8dqbM54Nxbn7VOdooXPuSnAKJ9vPDg1n5Y/GO+lgldNzfyK6g
-HnbldSu0zBvAaGvmAjLjetEtOkBqYkrHJlT6JAems/Kc/YX5uooAz9/jNJFXP9++
-KbjH3CzHZwKBgQC6ppxEDZPKi83nD/2NvMTIyFzcNFj0LaEepFW7vc7NkiSn0zrt
-0lEXWqUqEv5oaPWTEcHH2VdxFRTLuSL0LKGMnWqUqQcKDA9xrcSzuFvNhRTwHC81
-5XwwI1wBNV4sgFKj2WdW/6y2/szDt0oNxnC50zvkmlwOpPKBc4kmNaKmowKBgBmC
-uXIDIXyZcmw3QTNNWZNqXcnv8iRo4xN4dilOWyBxMfp3QmWI5feD4G2+0Jqr2nNZ
-iRRdB/bA3qtVQ0PinkDQBIzPg6lVNS1uv+TUNc4YgXtL+pyrq+Om8U/jMmqEQR9q
-0YltG49houSZyatnYGK6aSHgpNuaYD0jI66fsyYBAoGAMefyD0I/ncArjuf58hVQ
-zSjxfcvlja9okrC8ZgqsVluezcm4rQNcSjBnESGTCjJC7O29AofGLHkvnsBQDiGk
-hE38IRisd+okXdApr41ifWDhmtASud5q6wlhOpMmQxg+OALf1rTvFYhbnFEXV/KY
-e5A4iXLRIbxbmXZDa35Rebw=
------END PRIVATE KEY-----
diff --git a/grouper-midpoint/mp-gr/midpoint-server/Dockerfile b/grouper-midpoint/mp-gr/midpoint-server/Dockerfile
index 3f1c43e..e868209 100644
--- a/grouper-midpoint/mp-gr/midpoint-server/Dockerfile
+++ b/grouper-midpoint/mp-gr/midpoint-server/Dockerfile
@@ -9,18 +9,29 @@ MAINTAINER info@evolveum.com
 RUN rpm --import http://repos.azulsystems.com/RPM-GPG-KEY-azulsystems
 RUN curl -o /etc/yum.repos.d/zulu.repo http://repos.azulsystems.com/rhel/zulu.repo
 RUN yum -y update
-RUN yum -y install zulu-8
+RUN yum -y install \
+ 	zulu-8 \
+        cronie \
+        supervisor \
+	libcurl \
+	&& yum clean -y all
 
-RUN yum -y install supervisor
-COPY container_files/supervisor/supervisord.conf /etc/supervisord.conf
-
-RUN rm /etc/shibboleth/sp-key.pem /etc/shibboleth/sp-cert.pem /etc/httpd/conf.d/ssl.conf
+RUN rm /etc/shibboleth/sp-key.pem /etc/shibboleth/sp-cert.pem \
+    && cd /etc/httpd/conf.d/ \
+    && rm -f autoindex.conf ssl.conf userdir.conf welcome.conf
 
+COPY container_files/supervisor/supervisord.conf /etc/supervisord.conf
 COPY container_files/httpd/conf/* /etc/httpd/conf.d/
 COPY container_files/httpd/possible-conf/* /etc/httpd/possible-conf/
 COPY container_files/shibboleth/* /etc/shibboleth/
 COPY container_files/usr-local-bin/ /usr/local/bin/
 
+RUN chmod 755 /usr/local/bin/sendtierbeacon.sh \
+    && chmod 755 /usr/local/bin/setupcron.sh \
+    && chmod 755 /usr/local/bin/init.sh \
+    && chmod 755 /usr/local/bin/library.sh \
+    && /usr/local/bin/setupcron.sh
+
 RUN cp /dev/null /etc/httpd/conf.d/ssl.conf \
     && sed -i 's/LogFormat "/LogFormat "httpd;access_log;%{ENV}e;%{USERTOKEN}e;/g' /etc/httpd/conf/httpd.conf \
     && echo -e "\nErrorLogFormat \"httpd;error_log;%{ENV}e;%{USERTOKEN}e;[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i\"" >> /etc/httpd/conf/httpd.conf \
@@ -65,4 +76,7 @@ ENV AJP_ENABLED true
 ENV AJP_PORT 9090
 ENV LOGOUT_URL https://localhost:4438/Shibboleth.sso/Logout
 
+ENV TIER_RELEASE=test-non-release
+ENV TIER_MAINTAINER=tier
+
 CMD ["/usr/bin/supervisord"]
diff --git a/grouper-midpoint/mp-gr/midpoint-server/container_files/supervisor/supervisord.conf b/grouper-midpoint/mp-gr/midpoint-server/container_files/supervisor/supervisord.conf
index 64a201e..3db09ac 100644
--- a/grouper-midpoint/mp-gr/midpoint-server/container_files/supervisor/supervisord.conf
+++ b/grouper-midpoint/mp-gr/midpoint-server/container_files/supervisor/supervisord.conf
@@ -1,16 +1,11 @@
 [supervisord]
 nodaemon=true
 
-[program:init]
-command=/usr/local/bin/init.sh
-autostart=true
-
-[program:httpd-shib]
-command=httpd-shib-foreground
+[program:init-httpd-shib]
+command=/bin/bash -c "/usr/local/bin/init.sh && httpd-shib-foreground"
 stdout_logfile=/dev/fd/1
 stdout_logfile_maxbytes=0
 redirect_stderr=true
-autostart=true
 
 [program:midpoint]
 command=/bin/bash -c "java -Xmx2048M -Xms2048M -Dfile.encoding=UTF8 \
@@ -32,4 +27,10 @@ command=/bin/bash -c "java -Xmx2048M -Xms2048M -Dfile.encoding=UTF8 \
 stdout_logfile=/dev/fd/2
 stdout_logfile_maxbytes=0
 redirect_stderr=true
-autostart=true
+
+[program:tier-beacon]
+command=/usr/sbin/crond -i -m off
+stdout_logfile=/dev/fd/10
+stdout_logfile_maxbytes=0
+redirect_stderr=true
+autorestart=false
diff --git a/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/library.sh b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/library.sh
index f574a66..a02ce3f 100755
--- a/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/library.sh
+++ b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/library.sh
@@ -5,9 +5,9 @@ linkSecrets(){
     	local label_file=`basename $filepath`
     	local file=$(echo $label_file| cut -d'_' -f 2)
 
-    	if [ $label_file = shib_* ]; then
+    	if [[ $label_file == shib_* ]]; then
             ln -sf /run/secrets/$label_file /etc/shibboleth/$file
-    	elif [ "$label_file" = "host-key.pem" ]; then
+    	elif [ "$label_file" == "host-key.pem" ]; then
             ln -sf /run/secrets/host-key.pem /etc/pki/tls/private/host-key.pem
     	fi
      done
@@ -15,7 +15,7 @@ linkSecrets(){
 
 
 checkMidpointSecurityProfile(){
-     if [ $ACTIVE_PROFILE = *'sso'* ]; then
+     if [[ $ACTIVE_PROFILE = *'sso'* ]]; then
 	cp /etc/httpd/possible-conf/midpoint-www-with-shibboleth-sso.conf /etc/httpd/conf.d/midpoint-www.conf
      else
         cp /etc/httpd/possible-conf/midpoint-www-without-shibboleth-sso.conf /etc/httpd/conf.d/midpoint-www.conf
diff --git a/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/sendtierbeacon.sh b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/sendtierbeacon.sh
new file mode 100644
index 0000000..7cb469b
--- /dev/null
+++ b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/sendtierbeacon.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+LOGHOST="localhost"
+LOGPORT="80"
+
+messagefile="/tmp/beaconmsg"
+
+if [ -z "$TIER_BEACON_OPT_OUT" ]; then
+    cat > $messagefile <<EOF
+{
+    "msgType"          : "TIERBEACON",
+    "msgName"          : "TIER",
+    "msgVersion"       : "1.0",
+    "tbProduct"        : "MIDPOINT",
+    "tbProductVersion" : "$MP_VERSION",
+    "tbTIERRelease"    : "$TIER_RELEASE",
+    "tbMaintainer"     : "$TIER_MAINTAINER"
+}
+EOF
+
+    curl -s -XPOST "${LOGHOST}:${LOGPORT}/" -H 'Content-Type: application/json' -T $messagefile 1>/dev/null 2>&1
+    if [ $? -eq 0 ]; then
+        echo "tier_beacon;none;$ENV;$USERTOKEN;"`date`"; TIER beacon sent"
+    else
+        echo "tier_beacon;none;$ENV;$USERTOKEN;"`date`"; Failed to send TIER beacon"
+    fi
+
+    rm -f $messagefile 1>/dev/null 2>&1
+
+fi
diff --git a/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/setupcron.sh b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/setupcron.sh
new file mode 100644
index 0000000..7e5fbe8
--- /dev/null
+++ b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/setupcron.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+CRONTMPFILE=/tmp/cronfile
+
+echo "#send daily \"beacon\" to central" > ${CRONTMPFILE}
+#echo $(expr $RANDOM % 59) $(expr $RANDOM % 3) "* * * /usr/local/bin/sendtierbeacon.sh >> /tmp/logcrond 2>&1" >> ${CRONTMPFILE}
+echo 47 "* * * * /usr/local/bin/sendtierbeacon.sh >> /dev/fd/8 2>&1" >> ${CRONTMPFILE}
+chmod 644 ${CRONTMPFILE}
+crontab ${CRONTMPFILE}