diff --git a/README.md b/README.md
index 8fe42b3..dc2e6bd 100644
--- a/README.md
+++ b/README.md
@@ -14,3 +14,4 @@ to complete a deployment.
     * Internal Testing - (TEST) branch/repo that uses the "test bed" which is something that I2 provides (LDAP) and an element to make all integrations.  Appropriate for Jenkins and testing environments
   * `release` branch
     * External Testing - (RELEASE) branch/repo (ultimately will live in Subversion?) for end users
+
diff --git a/conf/access-control.xml b/conf/access-control.xml
index a9184e6..3853722 100644
--- a/conf/access-control.xml
+++ b/conf/access-control.xml
@@ -34,7 +34,7 @@
         </entry>
         
         <!--
-        <entry key="AccessByUser">
+        <entry key="AccessByAdminUser">
             <bean parent="shibboleth.PredicateAccessControl">
                 <constructor-arg>
                     <bean parent="shibboleth.Conditions.SubjectName" c:collection="#{'jdoe'}" />
diff --git a/conf/admin/admin.properties b/conf/admin/admin.properties
new file mode 100644
index 0000000..7f14b56
--- /dev/null
+++ b/conf/admin/admin.properties
@@ -0,0 +1,55 @@
+# Configure properties controlling administrative features
+
+#idp.status.logging = Status
+#idp.status.accessPolicy = AccessByIPAddress
+#idp.status.authenticated = false
+#idp.status.nonBrowserSupported = false
+#idp.status.resolveAttributes = false
+
+#idp.reload.logging = Reload
+#idp.reload.accessPolicy = AccessByIPAddress
+#idp.reload.authenticated = false
+#idp.reload.nonBrowserSupported = false
+#idp.reload.resolveAttributes = false
+
+#idp.resolvertest.logging = ResolverTest
+#idp.resolvertest.accessPolicy = AccessByIPAddress
+#idp.resolvertest.authenticated = false
+#idp.resolvertest.nonBrowserSupported = false
+#idp.resolvertest.resolveAttributes = false
+
+#idp.mdquery.logging = MetadataQuery
+#idp.mdquery.accessPolicy = AccessByIPAddress
+#idp.mdquery.authenticated = false
+#idp.mdquery.nonBrowserSupported = false
+#idp.mdquery.resolveAttributes = false
+
+#idp.metrics.logging = Metrics
+#idp.metrics.authenticated = false
+#idp.metrics.nonBrowserSupported = false
+#idp.metrics.resolveAttributes = false
+# See admin/metrics.xml for other configuration
+
+#idp.hello.logging = Hello
+#idp.hello.accessPolicy = AccessByAdminUser
+#idp.hello.authenticated = true
+#idp.hello.nonBrowserSupported = false
+#idp.hello.resolveAttributes = true
+
+#idp.lockout.logging = Lockout
+#idp.lockout.accessPolicy = AccessDenied
+#idp.lockout.authenticated = false
+#idp.lockout.nonBrowserSupported = false
+#idp.lockout.resolveAttributes = false
+
+#idp.storage.logging = Storage
+#idp.storage.accessPolicy = AccessDenied
+#idp.storage.authenticated = false
+#idp.storage.nonBrowserSupported = false
+#idp.storage.resolveAttributes = false
+
+#idp.unlock-keys.logging = UnlockKeys
+#idp.unlock-keys.accessPolicy = AccessDenied
+#idp.unlock-keys.authenticated = true
+#idp.unlock-keys.nonBrowserSupported = false
+#idp.unlock-keys.resolveAttributes = false
diff --git a/conf/admin/general-admin.xml b/conf/admin/general-admin.xml
deleted file mode 100644
index 2814bf6..0000000
--- a/conf/admin/general-admin.xml
+++ /dev/null
@@ -1,74 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-    xmlns:context="http://www.springframework.org/schema/context"
-    xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
-    xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
-    default-init-method="initialize"
-    default-destroy-method="destroy">
-
-    <util:list id="shibboleth.AvailableAdminFlows">
-    
-        <!-- Status Page -->
-        <bean parent="shibboleth.AdminFlow"
-            c:id="http://shibboleth.net/ns/profiles/status"
-            p:loggingId="%{idp.service.logging.status:Status}"
-            p:policyName="%{idp.status.accessPolicy:AccessByIPAddress}" />
-
-        <!-- Service Reload -->
-        <bean parent="shibboleth.AdminFlow"
-            c:id="http://shibboleth.net/ns/profiles/reload-service-configuration"
-            p:loggingId="%{idp.service.logging.serviceReload:Reload}"
-            p:policyName="%{idp.reload.accessPolicy:AccessByIPAddress}" />
-
-        <!-- MetadataResolver Reload -->
-        <bean parent="shibboleth.AdminFlow"
-            c:id="http://shibboleth.net/ns/profiles/reload-metadata"
-            p:loggingId="%{idp.service.logging.serviceReload:Reload}"
-            p:policyName="%{idp.reload.accessPolicy:AccessByIPAddress}" />
-
-        <!-- AttributeResolver Debugging -->
-        <bean parent="shibboleth.AdminFlow"
-            c:id="http://shibboleth.net/ns/profiles/resolvertest"
-            p:loggingId="%{idp.service.logging.resolvertest:ResolverTest}"
-            p:policyName="%{idp.resolvertest.accessPolicy:AccessByIPAddress}" />
-
-        <!-- Metadata Query -->
-        <bean parent="shibboleth.AdminFlow"
-            c:id="http://shibboleth.net/ns/profiles/mdquery"
-            p:loggingId="MetadataQuery"
-            p:policyName="AccessByIPAddress" />
-
-        <!-- REST AccountLockoutManager Access -->
-        <bean parent="shibboleth.AdminFlow"
-            c:id="http://shibboleth.net/ns/profiles/lockout-manager"
-            p:loggingId="Lockout"
-            p:policyName="AccessByIPAddress" />
-
-        <!-- REST StorageService Access -->
-        <bean parent="shibboleth.AdminFlow"
-            c:id="http://shibboleth.net/ns/profiles/storage"
-            p:loggingId="Storage"
-            p:policyName="AccessByIPAddress" />
-    
-        <!-- REST Interface to Metrics -->
-        <bean parent="shibboleth.AdminFlow"
-            c:id="http://shibboleth.net/ns/profiles/metrics"
-            p:loggingId="Metrics"
-            p:policyNameLookupStrategy-ref="shibboleth.metrics.AccessPolicyStrategy" />
-
-        <!-- Attended Startup Unlock -->
-        <!--
-        <bean parent="shibboleth.OneTimeAdminFlow"
-            c:id="http://shibboleth.net/ns/profiles/unlock-keys"
-            p:loggingId="UnlockKeys"
-            p:authenticated="true"
-            p:policyName="AccessByAdminUser" />
-        -->
-    
-    </util:list>
-
-</beans>
diff --git a/conf/admin/metrics.xml b/conf/admin/metrics.xml
index fccf419..208ab6b 100644
--- a/conf/admin/metrics.xml
+++ b/conf/admin/metrics.xml
@@ -26,6 +26,7 @@
                 <ref bean="shibboleth.metrics.MetadataGaugeSet" />
                 <ref bean="shibboleth.metrics.NameIdentifierGaugeSet" />
                 <ref bean="shibboleth.metrics.RelyingPartyGaugeSet" />
+                <ref bean="shibboleth.metrics.AttributeRegistryGaugeSet" />
                 <ref bean="shibboleth.metrics.AttributeResolverGaugeSet" />
                 <ref bean="shibboleth.metrics.AttributeFilterGaugeSet" />
                 <ref bean="shibboleth.metrics.CASServiceRegistryGaugeSet" />
@@ -59,12 +60,20 @@
         <entry key="metadata" value-ref="shibboleth.metrics.MetadataGaugeSet" />
         <entry key="nameid" value-ref="shibboleth.metrics.NameIdentifierGaugeSet" />
         <entry key="relyingparty" value-ref="shibboleth.metrics.RelyingPartyGaugeSet" />
+        <entry key="registry" value-ref="shibboleth.metrics.AttributeRegistryGaugeSet" />
         <entry key="resolver" value-ref="shibboleth.metrics.AttributeResolverGaugeSet" />
         <entry key="filter" value-ref="shibboleth.metrics.AttributeFilterGaugeSet" />
         <entry key="cas" value-ref="shibboleth.metrics.CASServiceRegistryGaugeSet" />
         <entry key="bean" value-ref="shibboleth.metrics.ManagedBeanGaugeSet" />
     </util:map>
-        
+
+    <!-- Add any desired properties into set to expose them as IdP metrics. -->
+    <!--
+    <util:set id="shibboleth.metrics.ExposedProperties">
+        <value>idp.entityID</value>
+    </util:set>
+    -->
+    
     <!-- If you don't specify an alternate access policy, this named policy will be enforced. -->
     <bean id="shibboleth.metrics.DefaultAccessPolicy" class="java.lang.String" c:_0="AccessByIPAddress" />
     
diff --git a/conf/attribute-resolver.xml b/conf/attribute-resolver.xml
index 0ee236b..8d16a59 100644
--- a/conf/attribute-resolver.xml
+++ b/conf/attribute-resolver.xml
@@ -1,17 +1,16 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!-- 
-    This file is an EXAMPLE configuration file. While the configuration
-    presented in this example file is semi-functional, it isn't very
-    interesting. It is here only as a starting point for your deployment
-    process.
-    
-    Very few attribute definitions and data connectors are demonstrated,
-    and the data is derived statically from the logged-in username and a
-    static example connector.
+This file is a rudimentary example. While it is semi-functional, it isn't very
+interesting. It is here only as a starting point for your deployment process
+to avoid any dependency on components like an LDAP directory.
 
-    Attribute-resolver-full.xml contains more examples of attributes,
-    encoders, and data connectors. Deployers should refer to the Shibboleth
-    documentation for a complete list of components and their options.
+Very few attribute definitions and data connectors are demonstrated, and the
+data is derived statically from the logged-in username and a static example
+connector.
+
+The file(s) in the examples directory contain more examples that involve more
+complex approaches. Deployers should refer to the documentation for a complete
+list of possible components and their options.
 -->
 <AttributeResolver
         xmlns="urn:mace:shibboleth:2.0:resolver" 
diff --git a/conf/attributes/inetOrgPerson.xml b/conf/attributes/inetOrgPerson.xml
index da4cdcf..f2aebb1 100644
--- a/conf/attributes/inetOrgPerson.xml
+++ b/conf/attributes/inetOrgPerson.xml
@@ -447,8 +447,8 @@
                 <props merge="true">
                     <prop key="id">telephoneNumber</prop>
                     <prop key="transcoder">SAML2StringTranscoder SAML1StringTranscoder</prop>
-                    <prop key="saml2.name">urn:mace:dir:attribute-def:telephoneNumber</prop>
-                    <prop key="saml1.name">urn:oid:2.5.4.20</prop>
+                    <prop key="saml2.name">urn:oid:2.5.4.20</prop>
+                    <prop key="saml1.name">urn:mace:dir:attribute-def:telephoneNumber</prop>
                     <prop key="displayName.en">Business phone number</prop>
                     <prop key="displayName.de">Telefon Geschäft</prop>
                     <prop key="displayName.fr">Teléphone professionnel</prop>
diff --git a/conf/audit.xml b/conf/audit.xml
index a9faf4c..42d82b8 100644
--- a/conf/audit.xml
+++ b/conf/audit.xml
@@ -19,7 +19,7 @@
 
     <!-- Override the format of date/time fields in the log and/or convert to default time zone. -->
     <!--
-    <bean id="shibboleth.AuditDateTimeFormat" class="java.lang.String" c:_0="YYYY-MM-dd'T'HH:mm:ss.SSSZZ" />
+    <bean id="shibboleth.AuditDateTimeFormat" class="java.lang.String" c:_0="yyyy-MM-dd'T'HH:mm:ss.SSSZZ" />
     <util:constant id="shibboleth.AuditDefaultTimeZone" static-field="java.lang.Boolean.TRUE" />
     -->
 
diff --git a/conf/authn/authn-comparison.xml b/conf/authn/authn-comparison.xml
index dcf0271..0730bcb 100644
--- a/conf/authn/authn-comparison.xml
+++ b/conf/authn/authn-comparison.xml
@@ -12,62 +12,33 @@
        default-destroy-method="destroy">
 
     <!--
-    These beans can be used in the AuthnComparisonRules map below instead of the defaults to
-    support more advanced matching rules. The top example shows how to configure a matching rule,
-    in this case a rule that the two listed classes are "better" than the password class.
-    
-    To use these beans, configure the matchingRules map as desired, and then reference the bean id in the
-    desired value-ref slot in the AuthnComparisonRules map.
+    This is a map used to "weight" particular methods above others if the IdP has to randomly select one
+    to insert into a SAML authentication statement. The typical use shown below is to bias the IdP in favor
+    of expressing the SAML 2 PasswordProtectedTransport class over the more vanilla Password class on the
+    assumption that the IdP doesn't accept passwords via an insecure channel. This map never causes the IdP
+    to violate its matching rules if an RP requests a particular value; it only matters when nothing specific
+    is chosen. Anything not in the map has a weight of zero.
     -->
     
-    <bean id="shibboleth.BetterClassRefMatchFactory" parent="shibboleth.InexactMatchFactory">
-        <!--
-        <property name="matchingRules">
-            <map>
-                <entry key="urn:oasis:names:tc:SAML:2.0:ac:classes:Password">
-                    <list>
-                        <value>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</value>
-                        <value>urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken</value>
-                    </list>
-                </entry>
-            </map>
-        </property>
-        -->
-    </bean>
-
-    <bean id="shibboleth.MinimumClassRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
-
-    <bean id="shibboleth.MaximumClassRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
+    <util:map id="shibboleth.AuthenticationPrincipalWeightMap">
+        <entry>
+            <key>
+                <bean parent="shibboleth.SAML2AuthnContextClassRef"
+                    c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
+            </key>
+            <value>1</value>
+        </entry>
+    </util:map>
 
-    <!-- DeclRefs are rarely used in SAML, so you likely won't bother with these. -->
-    <bean id="shibboleth.BetterDeclRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
-    <bean id="shibboleth.MinimumDeclRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
-    <bean id="shibboleth.MaximumDeclRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
-    
-    
-    <!-- Registry of matching rules. -->
-    
+    <!--
+    Uncomment and add entries to this map to support "inexact" SAML RequestedAuthnContext operators.
+    Please refer to the AuthenticationFlowSelection documentation topic for details and examples. 
+    -->
+    <!--
     <util:map id="shibboleth.AuthnComparisonRules">
-    
-        <!-- Exact matching, should be left alone to avoid tricking the IdP into behaving incorrectly. -->
-        <entry key-ref="shibboleth.SAMLAuthnMethodExact" value-ref="shibboleth.ExactMatchFactory"/>
-        <entry key-ref="shibboleth.SAMLACClassRefExact" value-ref="shibboleth.ExactMatchFactory"/>
-        <entry key-ref="shibboleth.SAMLACDeclRefExact" value-ref="shibboleth.ExactMatchFactory"/>
-
-        <!-- Minimum matching, leave to allow degeneration into exact, or replace with custom rules. -->
-        <entry key-ref="shibboleth.SAMLACClassRefMinimum" value-ref="shibboleth.ExactMatchFactory"/>
-        <entry key-ref="shibboleth.SAMLACDeclRefMinimum" value-ref="shibboleth.ExactMatchFactory"/>
-
-        <!-- Maximum matching, leave to allow degeneration into exact, or replace with custom rules. -->
-        <entry key-ref="shibboleth.SAMLACClassRefMaximum" value-ref="shibboleth.ExactMatchFactory"/>
-        <entry key-ref="shibboleth.SAMLACDeclRefMaximum" value-ref="shibboleth.ExactMatchFactory"/>
-
-        <!-- Better matching, refers to empty ruleset that has to be populated to work. -->
-        <entry key-ref="shibboleth.SAMLACClassRefBetter" value-ref="shibboleth.BetterClassRefMatchFactory"/>
-        <entry key-ref="shibboleth.SAMLACDeclRefBetter" value-ref="shibboleth.BetterDeclRefMatchFactory"/>
-        
     </util:map>
-    
+    -->
+
     <!-- List of context classes or declarations to ignore if an SP requests them. -->
 
     <util:list id="shibboleth.IgnoredContexts">
diff --git a/conf/authn/authn.properties b/conf/authn/authn.properties
new file mode 100644
index 0000000..56111ef
--- /dev/null
+++ b/conf/authn/authn.properties
@@ -0,0 +1,213 @@
+# Properties that control authentication generally and the behavior of
+# specific methods.
+
+# Regular expression matching login flows to enable, e.g. IPAddress|Password
+#idp.authn.flows = Password
+
+# Default settings for most authentication methods.
+#idp.authn.defaultLifetime = PT1H
+#idp.authn.defaultTimeout = PT30M
+#idp.authn.proxyRestrictionsEnforced = true
+
+# Whether to populate relying party user interface information for display
+# during authentication, consent, terms-of-use.
+#idp.authn.rpui = true
+
+# Whether to prioritize "active" results when an SP requests more than
+# one possible matching login method (V2 behavior was to favor them)
+#idp.authn.favorSSO = false
+
+# Whether to fail requests when a user identity after authentication
+# doesn't match the identity in a pre-existing session.
+#idp.authn.identitySwitchIsError = false
+
+# If using IdP discovery feature, provides a discovery location to use.
+#idp.authn.discoveryURL = https://ds.example.org/shibboleth-ds/index.html
+
+# Properties below override specific method behavior, as an alternative
+# to defining Spring beans in XML. Refer to the documentation for a complete
+# list. Many of the properties below are mentioned only because they are
+# atypical defaults assumed for a given method.
+
+# Flow selection among multiple equivalent options can be managed with
+# the order properties, lower will be tried first.
+
+#### Password ####
+
+#idp.authn.Password.order = 1000
+#idp.authn.Password.passiveAuthenticationSupported = true
+#idp.authn.Password.forcedAuthenticationSupported = true
+# Override this and removeAfterValidation to require all validators to succeed
+#idp.authn.Password.requireAll = false
+# Override to keep the password around
+#idp.authn.Password.removeAfterValidation = true
+# Override to store password in Java Subject
+#idp.authn.Password.retainAsPrivateCredential = false
+# Simple username transforms before validation
+#idp.authn.Password.trim = true
+#idp.authn.Password.lowercase = false
+#idp.authn.Password.uppercase = false
+#idp.authn.Password.matchExpression = 
+# Override default form field names
+#idp.authn.Password.usernameFieldName = j_username
+#idp.authn.Password.passwordFieldName = j_password
+#idp.authn.Password.ssoBypassFieldName = donotcache
+# Unset if using customized Principals per validator
+#idp.authn.Password.addDefaultPrincipals = true
+# The Principal collection below is the typical default if not otherwise noted.
+#idp.authn.Password.supportedPrincipals = \
+#    saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, \
+#    saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \
+#    saml1/urn:oasis:names:tc:SAML:1.0:am:password
+# Validators are controlled in password-authn-config.xml
+
+#### Password Backends ####
+
+# See ldap.properties for LDAP authn properties
+# Kerberos settings
+#idp.authn.Krb5.refreshConfig = false
+#idp.authn.Krb5.preserveTicket = false
+# Set next two for KDC verification
+#idp.authn.Krb5.servicePrincipal = 
+#idp.authn.Krb5.keytab = 
+# JAAS settings
+#idp.authn.JAAS.loginConfigNames = ShibUserPassAuth
+#idp.authn.JAAS.loginConfig = %{idp.home}/conf/authn/jaas.config
+
+#### External ####
+
+#idp.authn.External.order = 1000
+#idp.authn.External.nonBrowserSupported = false
+#idp.authn.External.matchExpression = 
+# Unset if you plan to return full Java Subject from external source
+#idp.authn.External.addDefaultPrincipals = true
+# Servlet context-relative path to wherever your implementation lives
+idp.authn.External.externalAuthnPath = contextRelative:external.jsp
+
+#### RemoteUser ####
+
+#idp.authn.RemoteUser.order = 1000
+#idp.authn.RemoteUser.nonBrowserSupported = false
+#idp.authn.RemoteUser.matchExpression = 
+# Unset in most cases only if using the authnMethodHeader or
+# subjectAttribute settings
+#idp.authn.RemoteUser.addDefaultPrincipals = true
+# Most other settings need to be supplied via web.xml to the servlet
+
+#### RemoteUserInternal ####
+
+#idp.authn.RemoteUserInternal.order = 1000
+#idp.authn.RemoteUserInternal.nonBrowserSupported = true
+# Unset in most cases only if using the authnMethodHeader feature
+#idp.authn.RemoteUserInternal.addDefaultPrincipals = true
+#idp.authn.RemoteUserInternal.checkRemoteUser = true
+# Comma-delimited lists of attributes or headers to pull from
+#idp.authn.RemoteUserInternal.checkAttributes = 
+#idp.authn.RemoteUserInternal.checkHeaders = 
+# Simple transforms to apply
+#idp.authn.RemoteUserInternal.trim = true
+#idp.authn.RemoteUserInternal.lowercase = false
+#idp.authn.RemoteUserInternal.uppercase = false
+#idp.authn.RemoteUserInternal.matchExpression = 
+#idp.authn.RemoteUserInternal.allowedUsernames = 
+#idp.authn.RemoteUserInternal.deniedUsernames = 
+
+#### SPNEGO ####
+
+#idp.authn.SPNEGO.order = 1000
+#idp.authn.SPNEGO.nonBrowserSupported = false
+#idp.authn.SPNEGO.enforceRun = false
+#idp.authn.SPNEGO.refreshKrbConfig = false
+#idp.authn.SPNEGO.matchExpression = 
+idp.authn.SPNEGO.supportedPrincipals = \
+    saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos, \
+    saml1/urn:ietf:rfc:1510
+
+#### X509 ####
+
+#idp.authn.X509.order = 1000
+#idp.authn.X509.nonBrowserSupported = false
+# Servlet context-relative path to wherever your implementation lives
+#idp.authn.X509.externalAuthnPath = contextRelative:x509-prompt.jsp
+idp.authn.X509.supportedPrincipals = \
+    saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:X509, \
+    saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient, \
+    saml1/urn:ietf:rfc:2246
+
+#### X509Internal ####
+
+#idp.authn.X509Internal.order = 1000
+#idp.authn.X509Internal.nonBrowserSupported = false
+#idp.authn.X509Internal.saveCertificateToCredentialSet = true
+idp.authn.X509Internal.supportedPrincipals = \
+    saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:X509, \
+    saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient, \
+    saml1/urn:ietf:rfc:2246
+
+#### IPAddress ####
+
+#idp.authn.IPAddress.order = 1000
+#idp.authn.IPAddress.passiveAuthenticationSupported = true
+#idp.authn.IPAddress.lifetime = PT60S
+#idp.authn.IPAddress.inactivityTimeout = PT60S
+idp.authn.IPAddress.supportedPrincipals = \
+   saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol
+
+#### Function ####
+
+#idp.authn.Function.order = 1000
+#idp.authn.Function.passiveAuthenticationSupported = true
+# Unset if you plan to return full Java Subject from function
+#idp.authn.Function.addDefaultPrincipals = true
+
+#### Duo ####
+
+#idp.authn.Duo.order = 1000
+#idp.authn.Duo.nonBrowserSupported = false
+#idp.authn.Duo.forcedAuthenticationSupported = true
+# Unset if you have advanced Duo integrations with individualized Principals
+#idp.authn.Duo.addDefaultPrincipals = true
+# The list below should be changed to reflect whatever locally- or
+# community-defined values are appropriate to represent Duo. It is
+# strongly advised that the value not be specific to Duo or any
+# particular technology to avoid lock-in.
+idp.authn.Duo.supportedPrincipals = \
+    saml2/http://example.org/ac/classes/mfa, \
+    saml1/http://example.org/ac/classes/mfa
+# Default Duo integration settings are defined separately
+# in duo.properties due to the sensitivity of the secret key.
+
+
+#### SAML ####
+
+#idp.authn.SAML.order = 1000
+#idp.authn.SAML.nonBrowserSupported = false
+#idp.authn.SAML.passiveAuthenticationSupported = true
+#idp.authn.SAML.forcedAuthenticationSupported = true
+#idp.authn.SAML.proxyScopingEnforced = true
+# Discovery options:
+#   Define shibboleth.authn.SAML.discoveryFunction bean
+#   Set proxyEntityID property
+#   Fall through to discovery via discoveryRequired property
+#idp.authn.SAML.proxyEntityID = https://idp.example.org/idp/shibboleth
+#idp.authn.SAML.discoveryRequired = true
+# Generally left false with bidirectional mappings in
+# conf/authn/authn-comparison.xml across the proxy boundary.
+#idp.authn.SAML.addDefaultPrincipals = false
+
+#### MFA ####
+
+#idp.authn.MFA.order = 1000
+#idp.authn.MFA.passiveAuthenticationSupported = true
+#idp.authn.MFA.forcedAuthenticationSupported = true
+#idp.authn.MFA.validateLoginTransitions = true
+# The list below almost certainly requires changes, and should generally be the
+# union of any of the separate factors you combine in your particular MFA flow
+# rules. The example corresponds to the example in mfa-authn-config.xml that
+# combines IPAddress with Password.
+idp.authn.MFA.supportedPrincipals = \
+    saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol, \
+    saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, \
+    saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \
+    saml1/urn:oasis:names:tc:SAML:1.0:am:password
+# Most actual setup via mfa-authn-config.xml
diff --git a/conf/authn/discovery-config.xml b/conf/authn/discovery-config.xml
deleted file mode 100644
index e21e3fd..0000000
--- a/conf/authn/discovery-config.xml
+++ /dev/null
@@ -1,34 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!-- Specify discovery service location. -->
-    
-    <bean id="shibboleth.authn.discoveryURL" class="java.lang.String"
-        c:_0="https://ds.example.org/shibboleth-ds/index.html" />
- 
-    <!-- Alternatively specify a Function<ProfileRequestContext,String> to return the URL. -->
-    <!--
-    <bean id="shibboleth.authn.discoveryURLStrategy"
-            parent="shibboleth.ContextFunction.Scripted" factory-method="inlineScript">
-        <constructor-arg>
-            <value>
-            <![CDATA[
-                "https://ds.example.org/shibboleth-ds/index.html";
-            ]]>
-            </value>
-        </constructor-arg>
-    </bean>
-    -->
- 
-</beans>
diff --git a/conf/authn/duo-authn-config.xml b/conf/authn/duo-authn-config.xml
deleted file mode 100644
index 2867f48..0000000
--- a/conf/authn/duo-authn-config.xml
+++ /dev/null
@@ -1,29 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans" xmlns:context="http://www.springframework.org/schema/context"
-    xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p" xmlns:c="http://www.springframework.org/schema/c"
-    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
-    default-init-method="initialize" default-destroy-method="destroy">
-
-    <!--
-    By default, the Duo flow will use statically-defined integrations defined with the
-    duo.properties file. If you need more flexibility, you can define a function bean
-    called "shibboleth.authn.Duo.DuoIntegrationStrategy" to return an instance of
-    net.shibboleth.idp.authn.duo.DuoIntegration based on the state of the request.
-    A second bean, "shibboleth.authn.Duo.NonBrowser.DuoIntegrationStrategy", can be
-    supplied to use the AuthAPI for non-browser profiles.
-
-    The Duo flow is designed to operate in conjunction with some other login flow,
-    usually orchestrated by the MFA login flow. It obtains the username to send to
-    Duo based on the output of the other login flow or a previous session with the
-    user. You can override that approach using a function bean called
-    "shibboleth.authn.Duo.UsernameLookupStrategy" to supply the username from a
-    different source.
-    
-    Various other beans are supported, per the documentation.
-    -->
-
-</beans>
diff --git a/conf/authn/duo.properties b/conf/authn/duo.properties
deleted file mode 100644
index cb4b4aa..0000000
--- a/conf/authn/duo.properties
+++ /dev/null
@@ -1,30 +0,0 @@
-## Duo integration settings
-
-## Note: If upgrading from pre-3.3 IdP versions, you will need to manually add a pointer
-## to this property file to idp.properties.
-
-## The first set of properties support DuoWeb "iframe" integration.
-
-idp.duo.apiHost = hostname
-idp.duo.applicationKey = key
-idp.duo.integrationKey = key
-idp.duo.secretKey = key
-
-## The second set are used for direct AuthAPI usage for ECP support.
-## A seperate integration has to be created for this to work.
-
-#idp.duo.nonbrowser.apiHost = %{idp.duo.apiHost}
-#idp.duo.nonbrowser.applicationKey = key
-#idp.duo.nonbrowser.integrationKey = key
-#idp.duo.nonbrowser.secretKey = key
-
-## Request header names for Duo non-browser credentials.
-# idp.duo.nonbrowser.header.factor = X-Shibboleth-Duo-Factor
-# idp.duo.nonbrowser.header.device = X-Shibboleth-Duo-Device
-# idp.duo.nonbrowser.header.passcode = X-Shibboleth-Duo-Passcode
-
-## Enables auto selection of factor/device if not specified by client. 
-# idp.duo.nonbrowser.auto = true
-
-## Enables transmission of client address to Duo during authentication.
-# idp.duo.nonbrowser.clientAddressTrusted = true
diff --git a/conf/authn/external-authn-config.xml b/conf/authn/external-authn-config.xml
deleted file mode 100644
index 9d6652a..0000000
--- a/conf/authn/external-authn-config.xml
+++ /dev/null
@@ -1,70 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!-- Servlet context-relative path to wherever your implementation lives. -->
-    <bean id="shibboleth.authn.External.externalAuthnPath" class="java.lang.String"
-        c:_0="contextRelative:external.jsp" />
-
-    <!--
-    Default is to always use the path in the bean above. If you want to determine it
-    dynamically, define a bean called "shibboleth.authn.External.externalAuthnPathStrategy"
-    of type Function<ProfileRequestContext,String> that returns the path to use.
-    -->
-
-    <!--
-    Add authentication flow descriptor's supportedPrincipals collection to the resulting Subject?
-    You would normally only unset this if you plan to return a fully decorated Java Subject from your
-    external authentication source.
-    -->
-    <util:constant id="shibboleth.authn.External.addDefaultPrincipals" static-field="java.lang.Boolean.TRUE" />
-
-    <!--
-    <bean id="shibboleth.authn.External.matchExpression" class="java.util.regex.Pattern" factory-method="compile"
-        c:_0="^(.+)@example\.edu]$" />
-    -->
-
-    <!--
-    Define entries here to map error messages returned by external modules and classify them as particular
-    kinds of errors for use in your templates and as events in flows.
-
-    Keys are events to signal, values are error codes.
-
-    The examples here just allow external signaling of the exact type of condition to record.
-    
-    If you want to "fall-through" to other login flows, include a mapping to "ReselectFlow".
-    -->
-    <util:map id="shibboleth.authn.External.ClassifiedMessageMap">
-        <entry key="UnknownUsername">
-            <list>
-                <value>UnknownUsername</value>
-            </list>
-        </entry>
-        <entry key="InvalidPassword">
-            <list>
-                <value>InvalidPassword</value>
-            </list>
-        </entry>
-        <entry key="ExpiredPassword">
-            <list>
-                <value>ExpiredPassword</value>
-            </list>
-        </entry>
-        <entry key="ExpiringPassword">
-            <list>
-                <value>ExpiringPassword</value>
-            </list>
-        </entry>
-    </util:map>
-    
-</beans>
diff --git a/conf/authn/function-authn-config.xml b/conf/authn/function-authn-config.xml
deleted file mode 100644
index cf7876a..0000000
--- a/conf/authn/function-authn-config.xml
+++ /dev/null
@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!--
-    Add authentication flow descriptor's supportedPrincipals collection to the resulting Subject?
-    You would normally only unset this if you plan to return a completely constructed Subject from
-    your authentication function.
-    -->
-    <util:constant id="shibboleth.authn.Function.addDefaultPrincipals" static-field="java.lang.Boolean.TRUE" />
-    
-    <!--
-    The entire flow depends on the execution of a function bean you supply. A pathological script example
-    is below. The function may return a String, Principal, Subject, or a null to signal failure.
-    -->
-    
-    <bean id="shibboleth.authn.Function.ResultLookupStrategy"
-            parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript">
-        <constructor-arg>
-            <value>
-            <![CDATA[
-                null;
-            ]]>
-            </value>
-        </constructor-arg>
-    </bean>    
-</beans>
diff --git a/conf/authn/general-authn.xml b/conf/authn/general-authn.xml
deleted file mode 100644
index b936f97..0000000
--- a/conf/authn/general-authn.xml
+++ /dev/null
@@ -1,173 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!--
-    This file provisions the IdP with information about the configured login mechanisms available for use.
-    The actual beans and subflows that make up those mechanisms are in their own files, but this pulls them
-    together with deployer-supplied metadata to describe them to the system.
-    
-    You can turn on and off individual mechanisms by adding and remove them here. Nothing left out will
-    be used, regardless any other files loaded by the Spring container.
-    
-    Flow defaults include: no support for IsPassive/ForceAuthn, support for non-browser clients enabled,
-    and default timeout and lifetime values set via properties. We also default to supporting the SAML 1/2
-    expressions for password-based authentication over a secure channel, so anything more exotic requires
-    customization, as the examples below for IP address and SPNEGO authentication illustrate.
-    -->
-
-    <util:list id="shibboleth.AvailableAuthenticationFlows">
-        
-        <bean id="authn/IPAddress" parent="shibboleth.AuthenticationFlow"
-                p:passiveAuthenticationSupported="true"
-                p:lifetime="PT60S" p:inactivityTimeout="PT60S">
-            <property name="supportedPrincipals">
-                <list>
-                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
-                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol" />
-                </list>
-            </property>
-        </bean>
-
-        <bean id="authn/SPNEGO" parent="shibboleth.AuthenticationFlow"
-                p:nonBrowserSupported="false">
-            <property name="supportedPrincipals">
-                <list>
-                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
-                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos" />
-                    <bean parent="shibboleth.SAML1AuthenticationMethod"
-                        c:method="urn:ietf:rfc:1510" />
-                </list>
-            </property>
-        </bean>
-        
-        <bean id="authn/Function" parent="shibboleth.AuthenticationFlow" />
-
-        <bean id="authn/X509" parent="shibboleth.AuthenticationFlow"
-                p:nonBrowserSupported="false">
-            <property name="supportedPrincipals">
-                <list>
-                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
-                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:X509" />
-                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
-                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient" />
-                    <bean parent="shibboleth.SAML1AuthenticationMethod"
-                        c:method="urn:ietf:rfc:2246" />
-                </list>
-            </property>
-        </bean>
-
-        <bean id="authn/X509Internal" parent="shibboleth.AuthenticationFlow">
-            <property name="supportedPrincipals">
-                <list>
-                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
-                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:X509" />
-                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
-                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient" />
-                    <bean parent="shibboleth.SAML1AuthenticationMethod"
-                        c:method="urn:ietf:rfc:2246" />
-                </list>
-            </property>
-        </bean>
-
-        <bean id="authn/Password" parent="shibboleth.AuthenticationFlow"
-                p:passiveAuthenticationSupported="true"
-                p:forcedAuthenticationSupported="true" />
-
-        <bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"
-                p:forcedAuthenticationSupported="true"
-                p:nonBrowserSupported="false">
-            <!--
-            The list below should be changed to reflect whatever locally- or
-            community-defined values are appropriate to represent MFA. It is
-            strongly advised that the value not be specific to Duo or any
-            particular technology.
-            -->
-            <property name="supportedPrincipals">
-                <list>
-                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
-                        c:classRef="http://example.org/ac/classes/mfa" />
-                    <bean parent="shibboleth.SAML1AuthenticationMethod"
-                        c:method="http://example.org/ac/classes/mfa" />
-                </list>
-            </property>
-        </bean>
-
-        <bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"
-                p:passiveAuthenticationSupported="true"
-                p:forcedAuthenticationSupported="true">
-            <!--
-            The list below almost certainly requires changes, and should generally be the
-            union of any of the separate factors you combine in your particular MFA flow
-            rules. The example corresponds to the example in mfa-authn-config.xml that
-            combines IPAddress with Password.
-            -->
-            <property name="supportedPrincipals">
-                <list>
-                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
-                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol" />
-                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
-                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
-                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
-                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
-                    <bean parent="shibboleth.SAML1AuthenticationMethod"
-                        c:method="urn:oasis:names:tc:SAML:1.0:am:password" />
-                </list>
-            </property>
-        </bean>
-
-        <!-- This is a flow for proxied SAML authentication to another IdP. -->
-
-        <bean id="authn/SAML" parent="shibboleth.AuthenticationFlow"
-            p:nonBrowserSupported="false"
-            p:passiveAuthenticationSupported="true"
-            p:forcedAuthenticationSupported="true"
-            p:proxyScopingEnforced="true"
-            p:discoveryRequired="true" />
-
-        <!--
-        These flows are often, though not exclusively, used to proxy authentication, so may need
-        the proxyScopingEnforced flag enabled by hand to honor RP/local proxy count limits,
-        and may optionally trigger discovery via the discoveryRequired flag.
-        -->
-
-        <bean id="authn/External" parent="shibboleth.AuthenticationFlow"
-            p:nonBrowserSupported="false" />
-
-        <bean id="authn/RemoteUser" parent="shibboleth.AuthenticationFlow"
-            p:nonBrowserSupported="false" />
-
-        <bean id="authn/RemoteUserInternal" parent="shibboleth.AuthenticationFlow" />
-
-    </util:list>
-
-    <!--
-    This is a map used to "weight" particular methods above others if the IdP has to randomly select one
-    to insert into a SAML authentication statement. The typical use shown below is to bias the IdP in favor
-    of expressing the SAML 2 PasswordProtectedTransport class over the more vanilla Password class on the
-    assumption that the IdP doesn't accept passwords via an insecure channel. This map never causes the IdP
-    to violate its matching rules if an RP requests a particular value; it only matters when nothing specific
-    is chosen. Anything not in the map has a weight of zero.
-    -->
-    
-    <util:map id="shibboleth.AuthenticationPrincipalWeightMap">
-        <entry>
-            <key>
-                <bean parent="shibboleth.SAML2AuthnContextClassRef"
-                    c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
-            </key>
-            <value>1</value>
-        </entry>
-    </util:map>
-
-</beans>
diff --git a/conf/authn/ipaddress-authn-config.xml b/conf/authn/ipaddress-authn-config.xml
deleted file mode 100644
index a3ee096..0000000
--- a/conf/authn/ipaddress-authn-config.xml
+++ /dev/null
@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-
-    <!-- Apply any regular expression replacement pairs to address before validation. -->
-    <util:list id="shibboleth.authn.IPAddress.Transforms" />
-
-    <!--
-    Configure the address range(s) and principal name(s) for IP-based login here.
-    The ranges provided MUST be CIDR network expressions. To specify a single address,
-    add "/32" or "/128" for IPv4 or IPv6 respectively.
-    -->
-
-
-    <util:map id="shibboleth.authn.IPAddress.Mappings">
-        <!--
-        <entry key="jdoe">
-            <list>
-                <value>127.0.0.1/32</value>
-                <value>::1/128</value>
-            </list>
-        </entry>
-        -->
-    </util:map>
-
-</beans>
diff --git a/conf/authn/jaas-authn-config.xml b/conf/authn/jaas-authn-config.xml
deleted file mode 100644
index 7edd41c..0000000
--- a/conf/authn/jaas-authn-config.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-    
-    <!-- Specify your JAAS config. -->
-    <bean id="JAASConfig" class="org.springframework.core.io.FileSystemResource" c:path="%{idp.home}/conf/authn/jaas.config" />
-    
-    <util:property-path id="shibboleth.authn.JAAS.JAASConfigURI" path="JAASConfig.URI" />
-    
-    <!-- Specify the application name(s) in the JAAS config. -->
-    <util:list id="shibboleth.authn.JAAS.LoginConfigNames">
-        <value>ShibUserPassAuth</value>
-    </util:list>
-
-</beans>
diff --git a/conf/authn/jaas.config b/conf/authn/jaas.config
deleted file mode 100644
index 232e93d..0000000
--- a/conf/authn/jaas.config
+++ /dev/null
@@ -1,11 +0,0 @@
-ShibUserPassAuth {
-    /*
-	com.sun.security.auth.module.Krb5LoginModule required;
-	*/
-
-    org.ldaptive.jaas.LdapLoginModule required
-      ldapUrl="ldap://localhost:10389"
-      baseDn="ou=people,dc=example,dc=org"
-      userFilter="uid={user}";
-
-};
\ No newline at end of file
diff --git a/conf/authn/krb5-authn-config.xml b/conf/authn/krb5-authn-config.xml
deleted file mode 100644
index f826f30..0000000
--- a/conf/authn/krb5-authn-config.xml
+++ /dev/null
@@ -1,29 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-    
-    <util:constant id="shibboleth.authn.Krb5.RefreshConfig" static-field="java.lang.Boolean.FALSE" />
-
-    <util:constant id="shibboleth.authn.Krb5.PreserveTicket" static-field="java.lang.Boolean.FALSE" />
-
-    <!--
-    Uncomment these beans to perform KDC verification using a service principal and keytab.
-    The keytab bean must be an absolute file pathname and not a reference to a classpath resource,
-    so if idp.home is not a path, don't use it in the value.
-    -->
-    <!--
-    <bean id="shibboleth.authn.Krb5.ServicePrincipal" class="java.lang.String" c:_0="SERVICE/principal" />
-    <bean id="shibboleth.authn.Krb5.Keytab" class="java.lang.String" c:_0="%{idp.home}/credentials/keytab" />
-    -->
-
-</beans>
diff --git a/conf/authn/ldap-authn-config.xml b/conf/authn/ldap-authn-config.xml
deleted file mode 100644
index 22a760b..0000000
--- a/conf/authn/ldap-authn-config.xml
+++ /dev/null
@@ -1,32 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans" xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p" xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-       default-init-method="initialize"
-       default-destroy-method="destroy"
-       default-lazy-init="true">
-
-    <!--
-    Default behavior is to rely on properties to populate the various beans.
-    You can override these, particularly shibboleth.authn.LDAP.authenticator,
-    to customize the settings or avoid use of properties.
-    
-    Be cautious of any direct dependency on ldaptive classes to simplify upgrades.
-    -->
-
-    <bean id="shibboleth.authn.LDAP.returnAttributes" parent="shibboleth.CommaDelimStringArray">
-        <constructor-arg type="java.lang.String" value="%{idp.authn.LDAP.returnAttributes:1.1}" />
-    </bean>
-
-    <bean id="shibboleth.authn.LDAP.trustCertificates" parent="shibboleth.X509ResourceCredentialConfig"
-        p:trustCertificates="%{idp.authn.LDAP.trustCertificates:undefined}" />
-        
-    <bean id="shibboleth.authn.LDAP.truststore" parent="shibboleth.KeystoreResourceCredentialConfig"
-        p:truststore="%{idp.authn.LDAP.trustStore:undefined}" />
-        
-    <bean id="shibboleth.authn.LDAP.authenticator" parent="shibboleth.LDAPAuthenticationFactory" lazy-init="true" />
-
-</beans>
diff --git a/conf/authn/mfa-authn-config.xml b/conf/authn/mfa-authn-config.xml
deleted file mode 100644
index 3bfbcbb..0000000
--- a/conf/authn/mfa-authn-config.xml
+++ /dev/null
@@ -1,78 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!--
-    This is a map of transition rules that guide the behavior of the MFA flow
-    and controls how factors are sequenced, skipped, etc. The key of each entry
-    is the name of the step/flow out of which control is passing. The starting
-    rule has an empty key.
-    
-    Each entry is a bean inherited from "shibboleth.authn.MFA.Transition". Per
-    the Javadoc for net.shibboleth.idp.authn.MultiFactorAuthenticationTransition:
-            
-        p:nextFlow (String)
-            - A flow to run if the previous step signaled a "proceed" event, for simple
-                transitions.
-                
-        p:nextFlowStrategy (Function<ProfileRequestContext,String>)
-            - A function to run if the previous step signaled a "proceed" event, for dynamic
-                transitions. Returning null ends the MFA process.
-            
-        p:nextFlowStrategyMap (Map<String,Object> where Object is String or Function<ProfileRequestContext,String>)
-            - Fully dynamic way of expressing control paths. Map is keyed by a previously
-                signaled event and the value is a flow to run or a function to
-                return the flow to run. Returning null ends the MFA process.
-                
-    When no rule is provided, there's an implicit "null" that ends the MFA flow
-    with whatever event was last signaled. If the "proceed" event from a step is
-    the final event, then the MFA process attempts to complete itself successfully.
-    -->
-    <util:map id="shibboleth.authn.MFA.TransitionMap">
-        <!-- First rule runs the IPAddress login flow. -->
-        <entry key="">
-            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/IPAddress" />
-        </entry>
-        
-        <!--
-        Second rule runs a function if IPAddress succeeds, to determine whether an additional
-        factor is required.
-        -->
-        <entry key="authn/IPAddress">
-            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSecondFactor" />
-        </entry>
-        
-        <!-- An implicit final rule will return whatever the final flow returns. -->
-    </util:map>
-
-    <!-- Example script to see if second factor is required. -->
-    <bean id="checkSecondFactor" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript">
-        <constructor-arg>
-            <value>
-            <![CDATA[
-                nextFlow = "authn/Password";
-
-                // Check if second factor is necessary for request to be satisfied.
-                authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
-                mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");
-                if (mfaCtx.isAcceptable()) {
-                    nextFlow = null;
-                }
-                
-                nextFlow;   // pass control to second factor or end with the first
-            ]]>
-            </value>
-        </constructor-arg>
-    </bean>
-    
-</beans>
diff --git a/conf/authn/password-authn-config.xml b/conf/authn/password-authn-config.xml
index 73ac7f8..4529b6f 100644
--- a/conf/authn/password-authn-config.xml
+++ b/conf/authn/password-authn-config.xml
@@ -13,34 +13,18 @@
        default-destroy-method="destroy">
     
     <!--
-    You can optionally comment out anything you don't need, but make sure not to
-    reference the corresponding validator in the list below if you do remove any.
-    -->
-    <import resource="jaas-authn-config.xml" />
-    <import resource="krb5-authn-config.xml" />
-    <import resource="ldap-authn-config.xml" />
+    Ordered list of CredentialValidators to apply to a request.
     
-    <!-- Ordered list of CredentialValidators to apply to a request. -->
+    The four supplied variants are shown below; the HTPasswd option
+    is an OOB default for demo account purposes, and you will
+    want to remove it after initial install and testing.
+    -->
     <util:list id="shibboleth.authn.Password.Validators">
         <ref bean="shibboleth.LDAPValidator" />
+        <!-- <ref bean="shibboleth.KerberosValidator" /> -->
+        <!-- <ref bean="shibboleth.JAASValidator" /> -->
+        <!-- <bean parent="shibboleth.HTPasswdValidator" p:resource="%{idp.home}/credentials/demo.htpasswd" /> -->
     </util:list>
-    
-    <!-- Controls whether all validators in the above bean have to succeed, or just one. -->
-    <util:constant id="shibboleth.authn.Password.RequireAll" static-field="java.lang.Boolean.FALSE"/>
-    
-    
-    <!-- Names of form fields to pull username and password from. -->
-    <bean id="shibboleth.authn.Password.UsernameFieldName" class="java.lang.String" c:_0="j_username" />
-    <bean id="shibboleth.authn.Password.PasswordFieldName" class="java.lang.String" c:_0="j_password" />
-    <bean id="shibboleth.authn.Password.SSOBypassFieldName" class="java.lang.String" c:_0="donotcache" />
-
-    <!-- Simple transforms to apply to username before validation. -->
-    <util:constant id="shibboleth.authn.Password.Lowercase" static-field="java.lang.Boolean.FALSE"/>
-    <util:constant id="shibboleth.authn.Password.Uppercase" static-field="java.lang.Boolean.FALSE"/>
-    <util:constant id="shibboleth.authn.Password.Trim" static-field="java.lang.Boolean.TRUE"/>
-
-    <!-- Set to TRUE if you want the password kept in the resulting Subject as a private credential. -->
-    <util:constant id="shibboleth.authn.Password.RetainAsPrivateCredential" static-field="java.lang.Boolean.FALSE"/>
 
     <!-- Apply any regular expression replacement pairs to username before validation. -->
     <util:list id="shibboleth.authn.Password.Transforms">
@@ -58,7 +42,7 @@
         p:lockoutDuration="PT5M"
         p:extendLockoutDuration="false" />
     -->
-
+      
     <!--
     Define entries here to map error messages detected by validation actions and classify them as particular
     kinds of errors for use in your templates and as events in flows.
@@ -72,7 +56,12 @@
                 <value>UnknownUsername</value>
                 <value>CLIENT_NOT_FOUND</value>
                 <value>Client not found</value>
+                <value>Cannot get kdc for realm</value>
+                <value>Client not found in Kerberos database</value>
                 <value>DN_RESOLUTION_FAILURE</value>
+                <value>Cannot authenticate dn, invalid dn</value>
+                <value>Cannot authenticate dn, invalid credential</value>
+                <value>AcceptSecurityContext error, data 525</value>
             </list>
         </entry>
         <entry key="InvalidPassword">
@@ -81,17 +70,31 @@
                 <value>PREAUTH_FAILED</value>
                 <value>INVALID_CREDENTIALS</value>
                 <value>Checksum failed</value>
+                <value>Integrity check on decrypted field failed</value>
+                <value>Pre-authentication information was invalid</value>
+                <value>Key bytes cannot be null</value>
+                <value>AcceptSecurityContext error, data 52e</value>
             </list>
         </entry>
         <entry key="AccountLocked">
             <list>
                 <value>AccountLocked</value>
                 <value>Clients credentials have been revoked</value>
+                <value>AcceptSecurityContext error, data 775</value>
+            </list>
+        </entry>
+        <entry key="AccountDisabled">
+            <list>
+                <value>AcceptSecurityContext error, data 533</value>
             </list>
         </entry>
         <entry key="ExpiredPassword">
             <list>
                 <value>PASSWORD_EXPIRED</value>
+                <value>CLIENT KEY EXPIRED</value>
+                <value>AcceptSecurityContext error, data 532</value>
+                <value>AcceptSecurityContext error, data 773</value>
+                <value>AcceptSecurityContext error, data 701</value>
             </list>
         </entry>
         <entry key="ExpiringPassword">
@@ -107,6 +110,9 @@
     </util:map>
 
     <!--
+    WARNING: This set of features is generally discouraged in favor of the MFA flow,
+    and while not deprecated, is not recommended for new deployments.
+    
     Configuration of "extended" login methods to offer in the password login form.
     
     The String bean is a regular expression identifying the flows to offer. These flows
diff --git a/conf/authn/remoteuser-authn-config.xml b/conf/authn/remoteuser-authn-config.xml
deleted file mode 100644
index 4b7e722..0000000
--- a/conf/authn/remoteuser-authn-config.xml
+++ /dev/null
@@ -1,75 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!-- Servlet context-relative path to wherever your implementation lives. -->
-    <bean id="shibboleth.authn.RemoteUser.externalAuthnPath" class="java.lang.String"
-        c:_0="contextRelative:Authn/RemoteUser" />
-    
-    <!--
-    Default is to always use the path in the bean above. If you want to determine it
-    dynamically, define a bean called "shibboleth.authn.RemoteUser.externalAuthnPathStrategy"
-    of type Function<ProfileRequestContext,String> that returns the path to use.
-    -->
-
-    <!--
-    Add authentication flow descriptor's supportedPrincipals collection to the resulting Subject?
-    You would normally only unset this if you plan to use the authnMethodHeader servlet parameter to
-    supply authentication method string(s) from the external authentication system.
-    -->
-    <util:constant id="shibboleth.authn.RemoteUser.addDefaultPrincipals" static-field="java.lang.Boolean.TRUE" />
-
-    <!--
-    <bean id="shibboleth.authn.RemoteUser.matchExpression" class="java.util.regex.Pattern" factory-method="compile"
-        c:_0="^(.+)@example\.edu]$" />
-    -->
-
-    <!--
-    Define entries here to map error messages returned by external modules and classify them as particular
-    kinds of errors for use in your templates and as events in flows.
-
-    Keys are events to signal, values are error codes.
-
-    The examples here just allow external signaling of an exact condition.
-    
-    If you want to "fall-through" to other login flows, include a mapping to "ReselectFlow".
-    -->
-    <util:map id="shibboleth.authn.RemoteUser.ClassifiedMessageMap">
-        <entry key="ReselectFlow">
-            <list>
-                <value>NoCredentials</value>
-            </list>
-        </entry>
-        <entry key="UnknownUsername">
-            <list>
-                <value>UnknownUsername</value>
-            </list>
-        </entry>
-        <entry key="InvalidPassword">
-            <list>
-                <value>InvalidPassword</value>
-            </list>
-        </entry>
-        <entry key="ExpiredPassword">
-            <list>
-                <value>ExpiredPassword</value>
-            </list>
-        </entry>
-        <entry key="ExpiringPassword">
-            <list>
-                <value>ExpiringPassword</value>
-            </list>
-        </entry>
-    </util:map>
-    
-</beans>
diff --git a/conf/authn/remoteuser-internal-authn-config.xml b/conf/authn/remoteuser-internal-authn-config.xml
deleted file mode 100644
index 9e68c85..0000000
--- a/conf/authn/remoteuser-internal-authn-config.xml
+++ /dev/null
@@ -1,63 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!-- Check getRemoteUser() for identity (the typical case). -->
-    <util:constant id="shibboleth.authn.RemoteUser.checkRemoteUser" static-field="java.lang.Boolean.TRUE"/>
-
-    <!-- Populate one or both of the lists below to define HTTP headers or Servlet Attributes to check. -->
-    
-    <util:list id="shibboleth.authn.RemoteUser.checkHeaders">
-        <!--
-        <value>User-Identity</value>
-        -->
-    </util:list>
-
-    <util:list id="shibboleth.authn.RemoteUser.checkAttributes">
-        <!--
-        <value>User-Identity</value>
-        -->
-    </util:list>
-    
-    <!-- Simple transforms to apply to username before validation. -->
-    <util:constant id="shibboleth.authn.RemoteUser.Lowercase" static-field="java.lang.Boolean.FALSE"/>
-    <util:constant id="shibboleth.authn.RemoteUser.Uppercase" static-field="java.lang.Boolean.FALSE"/>
-    <util:constant id="shibboleth.authn.RemoteUser.Trim" static-field="java.lang.Boolean.TRUE"/>
-
-    <!-- Apply any regular expression replacement pairs before validation. -->
-    <util:list id="shibboleth.authn.RemoteUser.Transforms">
-        <!--
-        <bean parent="shibboleth.Pair" p:first="^(.+)@example\.edu$" p:second="$1" />
-        -->
-    </util:list>
-    
-    <!-- Uncomment/configure to install username whitelist, blacklist, and/or match expressions. -->
-    
-    <util:list id="shibboleth.authn.RemoteUser.whitelistedUsernames">
-        <!--
-        <value>goodguy</value>
-        -->
-    </util:list>
-
-    <util:list id="shibboleth.authn.RemoteUser.blacklistedUsernames">
-        <!--
-        <value>badguy</value>
-        -->
-    </util:list>
-    
-    <!--
-    <bean id="shibboleth.authn.RemoteUser.matchExpression" class="java.util.regex.Pattern" factory-method="compile"
-        c:_0="^(.+)@example\.edu]$" />
-    -->
-    
-</beans>
diff --git a/conf/authn/saml-authn-config.xml b/conf/authn/saml-authn-config.xml
deleted file mode 100644
index 4ff55f9..0000000
--- a/conf/authn/saml-authn-config.xml
+++ /dev/null
@@ -1,35 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!--
-    Optional Function<ProfileRequest,String> to supply name of proxied IdP,
-    otherwise flow assumes IdP discovery has been performed already.
-    -->
-    <!--
-    <bean id="shibboleth.authn.SAML.discoveryFunction" parent="shibboleth.Functions.Constant"
-        c:target="https://idp.example.org/idp/shibboleth" />
-    -->
-    
-    <!--
-    Add authentication flow descriptor's supportedPrincipals collection to the
-    resulting Subject? This may be problematic if it happens without regard for
-    the information returned in the assertion from the IdP, so changing this is
-    likely to lead to violations of intent.
-    
-    Usually this should be left FALSE, and appropriate bidirectional mappings defined
-    via conf/authn/authn-comparison.xml to translate across the proxy boundary.
-    -->
-    <util:constant id="shibboleth.authn.SAML.addDefaultPrincipals" static-field="java.lang.Boolean.FALSE"/>
-
-</beans>
diff --git a/conf/authn/spnego-authn-config.xml b/conf/authn/spnego-authn-config.xml
deleted file mode 100644
index 6c0fa48..0000000
--- a/conf/authn/spnego-authn-config.xml
+++ /dev/null
@@ -1,74 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!--  General Configuration -->
-
-    <!--
-    Enforce running SPNEGO for all users, independent of user's autologin state.
-    TRUE means that SPNEGO login is always tried (if available).
-    FALSE means that SPNEGO login is run only if the user has enabled autologin.
-    -->
-    <util:constant id="shibboleth.authn.SPNEGO.EnforceRun" static-field="java.lang.Boolean.FALSE" />
-   
-    <!-- Kerberos Configuration-->
-
-    <!-- General Kerberos Settings -->
-    
-    <util:constant id="shibboleth.authn.SPNEGO.Krb5.RefreshConfig" static-field="java.lang.Boolean.FALSE" />
-
-    <!--  Kerberos Service Principal(s) -->
-    
-    <!--
-    For each service principal/realm, a "RealmSettings" bean must be created.
-    For each "RealmSettings" bean, the following settings are supported:
-      p:servicePrincipal: - kerberos service principal (required)
-      p:keytab:           - path to the keytab file containing the kerberos service principal's credentials
-                            (optional; either "p:keytab" or "p:password" is required)
-      p:password:         - kerberos service principal's password
-                            (optional; either "p:keytab" or "p:password" is required)
-    -->
-    <util:list id="shibboleth.authn.SPNEGO.Krb5.Realms">
-
-        <bean parent="shibboleth.KerberosRealmSettings"
-            p:servicePrincipal="HTTP/aai-logon.domain_a.com@DOMAIN_A.COM"
-            p:keytab="%{idp.home}/credentials/http_domainA.keytab" />
-
-    </util:list>
-
-    <!--
-    <bean id="shibboleth.authn.SPNEGO.matchExpression" class="java.util.regex.Pattern" factory-method="compile"
-        c:_0="^(.+)@example\.edu$" />
-    -->
-
-    <!--
-    Define entries here to map events or error messages returned by the SPNEGO module
-    and classify them as particular kinds of errors for use in your templates and as
-    events in flows.
-
-    Keys are events to signal, values are error codes.
-    -->
-    <util:map id="shibboleth.authn.SPNEGO.ClassifiedMessageMap">
-        <entry key="SPNEGONotAvailable">
-            <list>
-                <value>SPNEGONotAvailable</value>
-            </list>
-        </entry>
-        <entry key="NTLMUnsupported">
-            <list>
-                <value>NTLMUnsupported</value>
-            </list>
-        </entry>
-    </util:map>
- 
-</beans>
diff --git a/conf/authn/x509-authn-config.xml b/conf/authn/x509-authn-config.xml
deleted file mode 100644
index 18b015a..0000000
--- a/conf/authn/x509-authn-config.xml
+++ /dev/null
@@ -1,44 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!-- Servlet context-relative path to wherever your implementation lives. -->
-    <bean id="shibboleth.authn.X509.externalAuthnPath" class="java.lang.String"
-        c:_0="contextRelative:x509-prompt.jsp" />
-
-    <!--
-    Default is to always use the path in the bean above. If you want to determine it
-    dynamically, define a bean called "shibboleth.authn.X509.externalAuthnPathStrategy"
-    of type Function<ProfileRequestContext,String> that returns the path to use.
-    -->
-
-    <!--
-    Define entries here to map error messages returned by external modules and classify them as particular
-    kinds of errors for use in your templates and as events in flows.
-
-    Keys are events to signal, values are error codes.
-    
-    The examples here just allow external signaling of an exact condition.
-    
-    If you want to "fall-through" to other login flows, include a mapping to "ReselectFlow".
-    -->
-    <util:map id="shibboleth.authn.X509.ClassifiedMessageMap">
-        <entry key="ReselectFlow">
-            <list>
-                <value>NoCredentials</value>
-                <value>InvalidCredentials</value>
-            </list>
-        </entry>
-    </util:map>
-    
-</beans>
diff --git a/conf/authn/x509-internal-authn-config.xml b/conf/authn/x509-internal-authn-config.xml
deleted file mode 100644
index bad3029..0000000
--- a/conf/authn/x509-internal-authn-config.xml
+++ /dev/null
@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!--
-    You can define a TrustEngine to apply to any candidate certificates by defining a bean named
-    "shibboleth.authn.X509.TrustEngine". You could also define that in conf/global.xml if you need
-    to share one between the internal and external versions of this flow.
-    -->
-    
-</beans>
diff --git a/conf/c14n/attribute-sourced-subject-c14n-config.xml b/conf/c14n/attribute-sourced-subject-c14n-config.xml
deleted file mode 100644
index 938b30f..0000000
--- a/conf/c14n/attribute-sourced-subject-c14n-config.xml
+++ /dev/null
@@ -1,44 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!--
-    A list of attributes to resolve for normalizing the subject. For example, you might
-    intend to lookup a uid in a directory based on what the user entered. You can make this
-    an empty list if you just want to resolve everything you normally would.
-    -->
-    <util:list id="shibboleth.c14n.attribute.AttributesToResolve">
-        <value>altuid</value>
-    </util:list>
-    
-    <!--
-    A list of attributes to search for a value to produce as the normalized subject name.
-    This will normally be something you resolve above.
-    -->
-    <util:list id="shibboleth.c14n.attribute.AttributeSourceIds">
-        <value>altuid</value>
-    </util:list>
-
-    <!-- Simple transforms to apply to attribute value used for canonicalization result. -->
-    <util:constant id="shibboleth.c14n.attribute.Lowercase" static-field="java.lang.Boolean.FALSE"/>
-    <util:constant id="shibboleth.c14n.attribute.Uppercase" static-field="java.lang.Boolean.FALSE"/>
-    <util:constant id="shibboleth.c14n.attribute.Trim" static-field="java.lang.Boolean.TRUE"/>
-
-    <!-- Apply any regular expression replacement pairs. -->
-    <util:list id="shibboleth.c14n.attribute.Transforms">
-        <!--
-        <bean parent="shibboleth.Pair" p:first="^(.+)@example\.edu$" p:second="$1" />
-        -->
-    </util:list>
-        
-</beans>
diff --git a/conf/c14n/simple-subject-c14n-config.xml b/conf/c14n/simple-subject-c14n-config.xml
deleted file mode 100644
index 3cddfa6..0000000
--- a/conf/c14n/simple-subject-c14n-config.xml
+++ /dev/null
@@ -1,27 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!-- Simple transforms to apply to username after authentication. -->
-    <util:constant id="shibboleth.c14n.simple.Lowercase" static-field="java.lang.Boolean.FALSE"/>
-    <util:constant id="shibboleth.c14n.simple.Uppercase" static-field="java.lang.Boolean.FALSE"/>
-    <util:constant id="shibboleth.c14n.simple.Trim" static-field="java.lang.Boolean.TRUE"/>
-
-    <!-- Apply any regular expression replacement pairs after authentication. -->
-    <util:list id="shibboleth.c14n.simple.Transforms">
-        <!--
-        <bean parent="shibboleth.Pair" p:first="^(.+)@example\.edu$" p:second="$1" />
-        -->
-    </util:list>
-        
-</beans>
diff --git a/conf/c14n/subject-c14n.properties b/conf/c14n/subject-c14n.properties
new file mode 100644
index 0000000..3811493
--- /dev/null
+++ b/conf/c14n/subject-c14n.properties
@@ -0,0 +1,40 @@
+# Properties that control the behavior of post-login subject c14n flows.
+# A few more advanced settings require XML configuration, see flow-specific docs.
+
+
+# Simple username -> principal name c14n
+#idp.c14n.simple.lowercase = false
+#idp.c14n.simple.uppercase = false
+#idp.c14n.simple.trim = true
+
+
+# Attribute resolution -> principal name c14n
+#idp.c14n.attribute.lowercase = false
+#idp.c14n.attribute.uppercase = false
+#idp.c14n.attribute.trim = true
+# Lists of attributes to resolve...
+#idp.c14n.attribute.attributesToResolve =
+#  and then select a principal name from
+#idp.c14n.attribute.attributeSourceIds =
+# Allows direct use of attributes via SAML proxy authn, bypasses resolver
+#idp.c14n.attribute.resolveFromSubject = false
+#idp.c14n.attribute.resolutionCondition = shibboleth.Conditions.TRUE
+
+# X.509 certificate -> principal name c14n
+#idp.c14n.x500.lowercase = false
+#idp.c14n.x500.uppercase = false
+#idp.c14n.x500.trim = true
+# Precedence is to check for a subjectAltName and then an OID RDN
+# Comma-delimited list of subjectAltName type numbers
+#  (See https://tools.ietf.org/html/rfc5280#section-4.2.1.6)
+#idp.c14n.x500.subjectAltNameTypes = 
+# Comma-delimited list of OIDS
+#idp.c14n.x500.objectIDs = 
+
+# Proxied SAML NameID -> principal name c14n
+#idp.c14n.saml.proxy.lowercase = false
+#idp.c14n.saml.proxy.uppercase = false
+
+# NameID consumption from SAML requests
+#idp.c14n.saml.lowercase = false
+#idp.c14n.saml.uppercase = false
diff --git a/conf/c14n/subject-c14n.xml b/conf/c14n/subject-c14n.xml
index e4b772f..b354535 100644
--- a/conf/c14n/subject-c14n.xml
+++ b/conf/c14n/subject-c14n.xml
@@ -21,6 +21,8 @@
     principal name.
     
     Flows are identified with an ID that corresponds to a Spring Web Flow subflow name.
+    
+    Most of the simple settings that configure these flows are in subject-c14n.properties.
     -->
 
     <!--
@@ -31,9 +33,8 @@
     <util:list id="shibboleth.PostLoginSubjectCanonicalizationFlows">
         <!--
         This is an advanced post-login step that performs attribute resolution and then produces a username
-        from an attribute value. Most of this configuration is handled by attribute-sourced-c14n-config.xml.
-        To enable universally, just uncomment, but if you want it to run under more specific conditions,
-        set an activationCondition property to a condition function to use to control when it should run. 
+        from an attribute value. To enable universally, just uncomment, but if you want it to run under more
+        specific conditions, set an activationCondition property to a condition to apply. 
         -->
         <!-- <bean id="c14n/attribute" parent="shibboleth.PostLoginSubjectCanonicalizationFlow" /> -->
 
@@ -54,7 +55,7 @@
         <!--
         This is the standard post-login step that returns a username derived from the login process. If you
         have more complex needs such as mapping a certificate DN into a principal name, an alternative may
-        be required such as that above, but you can configure simple transforms in simple-subject-c14n-config.xml
+        be required such as that above, but you can use this for simple transforms.
         -->
         <ref bean="c14n/simple" />
     </util:list>
diff --git a/conf/c14n/x500-subject-c14n-config.xml b/conf/c14n/x500-subject-c14n-config.xml
deleted file mode 100644
index 1ae25e4..0000000
--- a/conf/c14n/x500-subject-c14n-config.xml
+++ /dev/null
@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!-- First priority is given to any subjectAltNames specified (emailAddress is 1) -->
-    <util:list id="shibboleth.c14n.x500.SubjectAltNameTypes">
-        <!-- <value>1</value> -->
-    </util:list>
-
-    <!-- Second priority is a list of Certificate Subject RDN OIDs to look for. -->
-    <util:list id="shibboleth.c14n.x500.ObjectIDs">
-        <value>2.5.4.3</value>
-    </util:list>
-
-    <!-- Simple transforms to apply to username after authentication. -->
-    <util:constant id="shibboleth.c14n.x500.Lowercase" static-field="java.lang.Boolean.FALSE"/>
-    <util:constant id="shibboleth.c14n.x500.Uppercase" static-field="java.lang.Boolean.FALSE"/>
-    <util:constant id="shibboleth.c14n.x500.Trim" static-field="java.lang.Boolean.TRUE"/>
-
-    <!-- Apply any regular expression replacement pairs after authentication. -->
-    <util:list id="shibboleth.c14n.x500.Transforms">
-        <!--
-        <bean parent="shibboleth.Pair" p:first="^(.+)@example\.edu$" p:second="$1" />
-        -->
-    </util:list>
-        
-</beans>
diff --git a/conf/cas-protocol.xml b/conf/cas-protocol.xml
deleted file mode 100644
index 2eb1733..0000000
--- a/conf/cas-protocol.xml
+++ /dev/null
@@ -1,106 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!--
-       | The CAS service registry defines verified relying parties by endpoint URI.
-       | The default implementation treats the ID of each entry as a regular expression defining a logical group of
-       | services whose URIs match the expression.
-       |
-       | This bean is reloaded periodically according to %{idp.home}/conf/services.properties.
-       -->
-    <bean id="reloadableServiceRegistry"
-          class="%{idp.cas.serviceRegistryClass:net.shibboleth.idp.cas.service.PatternServiceRegistry}">
-        <property name="definitions">
-            <list>
-                <!--
-                <bean class="net.shibboleth.idp.cas.service.ServiceDefinition"
-                      c:regex="https://([A-Za-z0-9_-]+\.)*example\.org(:\d+)?/.*"
-                      p:group="proxying-services"
-                      p:authorizedToProxy="true"
-                      p:singleLogoutParticipant="true" />
-                <bean class="net.shibboleth.idp.cas.service.ServiceDefinition"
-                      c:regex="http://([A-Za-z0-9_-]+\.)*example\.org(:\d+)?/.*"
-                      p:group="non-proxying-services"
-                      p:authorizedToProxy="false" /
-                -->
-            </list>
-        </property>
-    </bean>
-
-    <!--
-       | Uncomment this bean if you want to override the default list of CAS service registries.
-       | The default configuration tries to find the relying party in a SAML metadata source and falls back to
-       | reloadableServiceRegistry if a match is not found.
-       -->
-    <!--<util:list id="shibboleth.CASServiceRegistries">
-        <ref bean="shibboleth.CASMetadataServiceRegistry" />
-        <ref bean="shibboleth.CASServiceRegistry" />
-    </util:list>-->
-
-    <!--
-       | The default ticket service as of 3.3.0 serializes ticket data into the opaque section of the ticket ID
-       | for service tickets and proxy tickets. Proxy-granting tickets still require server-side storage, and
-       | a StorageService defined by the idp.cas.StorageService is used. Thus for deployers that do not require
-       | CAS proxy capabilities, no stateful storage mechanism is required; that means no memcached or database
-       | is required for HA deployments that want CAS (without proxy) support. A notable limitation of the new
-       | component is that the one-time use feature of service and proxy tickets is not available due to the lack
-       | of a ticket-tracking mechanism. Instead, tickets expire when their expiration period is exceeded.
-       | If this limitation is of concern, one may consider decreasing ticketValidityPeriod on the profile
-       | configuration from the default 15000ms.
-       -->
-    <alias name="encodingTicketService" alias="shibboleth.CASTicketService" />
-
-    <!--
-       | Uncomment the following element and comment out the above to enable the previous default ticket service
-       | that uses a StorageService for ticket persistence. Use this if the one-time use limitation of
-       | EncodingTicketService is problematic and can't be mitigated by decreasing ticketValidityPeriod.
-       -->
-    <!--<alias name="simpleTicketService" alias="shibboleth.CASTicketService" /> -->
-
-    <!--
-       | The predicate used to determine whether IdP session validation is performed during the process of granting
-       | a proxy ticket. When the predicate evaluates to true, an IdP session is resolved and validated prior to
-       | granting a proxy ticket. This feature prevents issuing proxy tickets when an IdP session is expired, but comes
-       | at the cost of requiring server-side storage of IdP session data. If this is configured to a predicate that
-       | evaluates to true under any condition, a server-side storage service must be enabled for IdP session
-       | storage. The most common non-default value is "alwaysTrue."
-       -->
-    <bean id="shibboleth.CASProxyValidateIdPSessionPredicate" parent="shibboleth.Conditions.FALSE" />
-
-    <!--
-       | Uncomment the following bean if you want to ignore jsessionid artifacts in service URLs.
-       | Those sorts of URLs are commonly emitted by Java servlet-based web applications.
-       -->
-    <!--<bean id="shibboleth.CASServiceComparator"
-          class="net.shibboleth.idp.cas.service.DefaultServiceComparator"
-          c:parameterNames="[a-z]+sessionid" />-->
-
-    <!--
-       | Define the list of static certificates that you trust to secure CAS proxy callback endpoints.
-       | Typically these are CA certificates and apply to _all_ CAS proxy callback endpoints.
-       | This facility complements the capability to supply relying-party-specific certificates in SAML metadata,
-       | which is the preferred mechanism to specify CAS proxy trust material. In the case of metadata, self-signed
-       | certificates are recommended.
-       -->
-    <util:list id="shibboleth.CASProxyTrustedCertificates" value-type="java.lang.String">
-        <!--<value>%{idp.home}/credentials/your_ca.pem</value>-->
-    </util:list>
-
-
-    <!-- ============== Advanced CAS Configuration ============== -->
-
-    <!-- Configure a third-party ticket service. -->
-    <!--
-    <bean id="shibboleth.CASTicketService"
-          class="org.example.idp.cas.CustomTicketService" />
-    -->
-</beans>
\ No newline at end of file
diff --git a/conf/errors.xml b/conf/errors.xml
index a5a8790..a9730c0 100644
--- a/conf/errors.xml
+++ b/conf/errors.xml
@@ -26,6 +26,7 @@
         <entry key="ImpersonationViolation" value="true" />
         <entry key="AttributeReleaseRejected" value="true" />
         <entry key="TermsRejected" value="true" />
+        <entry key="EndpointResolutionFailed" value="true" />
         <entry key="RuntimeException" value="false" />
         <entry key="InvalidEvent" value="false" />
         <entry key="InvalidCSRFToken" value="false" />
diff --git a/conf/attribute-resolver-ldap.xml b/conf/examples/attribute-resolver-ldap.xml
similarity index 84%
rename from conf/attribute-resolver-ldap.xml
rename to conf/examples/attribute-resolver-ldap.xml
index 19b68d6..ec375b4 100644
--- a/conf/attribute-resolver-ldap.xml
+++ b/conf/examples/attribute-resolver-ldap.xml
@@ -62,6 +62,10 @@
         connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
         trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"
         responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"
+        connectionStrategy="%{idp.attribute.resolver.LDAP.connectionStrategy}"
+        noResultIsError="true"
+        multipleResultsIsError="true"
+        excludeResolutionPhases="c14n/attribute"
         exportAttributes="mail displayName sn givenName departmentNumber employeeNumber eduPersonEntitlement eduPersonAssurance">
         <FilterTemplate>
             <![CDATA[
@@ -74,17 +78,24 @@
             blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
             validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"
             validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"
+            validateDN="%{idp.pool.LDAP.validateDN:}"
+            validateFilter="%{idp.pool.LDAP.validateFilter:(objectClass=*)}"
             expirationTime="%{idp.pool.LDAP.idleTime:PT10M}"/>
     </DataConnector>
 
-    <!-- DataConector for pairwise-id (example depends on saml-nameid.properties). -->
-
+    <!--
+    DataConnector for pairwise-id (example depends in part on saml-nameid.properties).
+    Note that this relies on BASE32 encoding in accordance with the attribute definition.
+    Older uses of this plugin for legacy eduPersonTargetedID/NameID values may require
+    different settings.
+    -->
 <!-- 
     <DataConnector id="computed" xsi:type="ComputedId"
+        excludeResolutionPhases="c14n/attribute"
 	    generatedAttributeID="computedId"
 	    salt="%{idp.persistentId.salt}"
 	    algorithm="%{idp.persistentId.algorithm:SHA}"
-        encoding="%{idp.persistentId.encoding:BASE32}">
+        encoding="BASE32">
 	    
         <InputDataConnector ref="myLDAP" attributeNames="%{idp.persistentId.sourceAttribute}" />
         
diff --git a/conf/global.xml b/conf/global.xml
index 457a814..c485f3f 100644
--- a/conf/global.xml
+++ b/conf/global.xml
@@ -15,23 +15,23 @@
     <!-- Use this file to define any custom beans needed globally. -->
 
     <!--
-    Algorithm whitelists and blacklists that override or merge with library defaults. Normally you can leave
-    these empty or commented and use the system defaults, but you can override those defaults using these lists.
-    Each <value> element is an algorithm URI, or you can use <util:constant> elements in place of literal values.
+    Algorithm include/exclude sets that override or merge with library defaults. Normally you can leave these
+    empty or commented and use the system defaults, but you can override those defaults using these beans.
+    Each <value> element is an algorithm URI; you can also use <util:constant> elements in place of literal values.
     -->
     
     <!--
-    <util:list id="shibboleth.SignatureWhitelist">
-    </util:list>
+    <util:set id="shibboleth.IncludedSignatureAlgorithms">
+    </util:set>
 
-    <util:list id="shibboleth.SignatureBlacklist">
-    </util:list>
+    <util:set id="shibboleth.ExcludedSignatureAlgorithms">
+    </util:set>
 
-    <util:list id="shibboleth.EncryptionWhitelist">
-    </util:list>
+    <util:set id="shibboleth.IncludedEncryptionAlgorithms">
+    </util:set>
 
-    <util:list id="shibboleth.EncryptionBlacklist">
-    </util:list>
+    <util:set id="shibboleth.ExcludedEncryptionAlgorithms">
+    </util:set>
     -->
 
     <!--
diff --git a/conf/idp.properties b/conf/idp.properties
index 7ea2766..24c20d9 100644
--- a/conf/idp.properties
+++ b/conf/idp.properties
@@ -1,5 +1,9 @@
-# Load any additional property resources from a comma-delimited list
-idp.additionalProperties=/conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/authn/duo.properties, /credentials/secrets.properties
+# Auto-load all files matching conf/**/*.properties
+# Disable if you want to manually maintain a list of sources.
+idp.searchForProperties=true
+
+# Load any "outside-tree" property sources from a comma-delimited list
+idp.additionalProperties=/credentials/secrets.properties
 
 # In most cases (and unless noted in the surrounding comments) the
 # commented settings in the distributed files document default behavior.
@@ -72,6 +76,10 @@ idp.encryption.cert=%{idp.home}/credentials/idp-encryption.crt
 # The new install default for encryption is now AES-GCM.
 idp.encryption.config=shibboleth.EncryptionConfiguration.GCM
 
+# Sets the default strategy for key agreement key wrap usage for credentials from metadata,
+# if not otherwise configured on the security configuration
+#idp.encryption.keyagreement.metadata.defaultUseKeyWrap = Default
+
 # Configures trust evaluation of keys used by services at runtime
 # Internal default is Chaining, overriden for new installs
 idp.trust.signatures=shibboleth.ExplicitKeySignatureTrustEngine
@@ -123,28 +131,13 @@ idp.session.secondaryServiceIndex=true
 # Length of time to track SP sessions
 #idp.session.defaultSPlifetime = PT2H
 
-# Regular expression matching login flows to enable, e.g. IPAddress|Password
-idp.authn.flows=Password
-
-# Default lifetime and timeout of various authentication methods
-#idp.authn.defaultLifetime = PT60M
-#idp.authn.defaultTimeout = PT30M
-
-# Whether to populate relying party user interface information for display
-# during authentication, consent, terms-of-use.
-#idp.authn.rpui = true
-
-# Whether to prioritize "active" results when an SP requests more than
-# one possible matching login method (V2 behavior was to favor them)
-#idp.authn.favorSSO = false
-
-# Whether to fail requests when a user identity after authentication
-# doesn't match the identity in a pre-existing session.
-#idp.authn.identitySwitchIsError = false
-
 # Set to "shibboleth.StorageService" or custom bean for alternate storage of consent
 #idp.consent.StorageService = shibboleth.ClientPersistentStorageService
 
+# Default consent auditing formats
+#idp.consent.terms-of-use.auditFormat = %T|%SP|%e|%u|%CCI|%CCV|%CCA
+#idp.consent.attribute-release.auditFormat = %T|%SP|%e|%u|%CCI|%CCV|%CCA
+
 # Set to "shibboleth.consent.AttributeConsentStorageKey" to use an attribute
 # to key user consent storage records (and set the attribute name)
 #idp.consent.attribute-release.userStorageKey = shibboleth.consent.PrincipalConsentStorageKey
@@ -169,7 +162,18 @@ idp.authn.flows=Password
 #idp.consent.expandedMaxStoredRecords = 0
 
 # Time in milliseconds to expire consent storage records.
-#idp.consent.storageRecordLifetime = P1Y
+# Leave commented out for the default of infinite
+#idp.consent.storageRecordLifetime =
+
+# Path to use with External interceptor flow
+#idp.intercept.External.externalPath = contextRelative:intercept.jsp
+
+# Policies to use with Impersonate interceptor flow
+#idp.impersonate.generalPolicy = GeneralImpersonationPolicy
+#idp.impersonate.specificPolicy = SpecificImpersonationPolicy
+
+# Picks outbound bindings more sensibly than based on metadata order
+idp.bindings.inMetadataOrder=false
 
 # Whether to lookup metadata, etc. for every SP involved in a logout
 # for use by user interface logic; adds overhead so off by default.
@@ -202,11 +206,10 @@ idp.authn.flows=Password
 # browser-supported languages, defaults to an empty list.
 idp.ui.fallbackLanguages=en,fr,de
 
-# Storage service used by CAS protocol
+# Storage service used by CAS protocol for chained proxy-granting tickets
+# and when using server-managed "simple" TicketService.
 # Defaults to shibboleth.StorageService (in-memory)
 # MUST be server-side storage (e.g. in-memory, memcached, database)
-# NOTE that idp.session.StorageService requires server-side storage
-# when CAS protocol is enabled
 #idp.cas.StorageService=shibboleth.StorageService
 
 # CAS service registry implementation class
@@ -216,11 +219,12 @@ idp.ui.fallbackLanguages=en,fr,de
 #idp.cas.relyingPartyIdFromMetadata=false
 
 # F-TICKS auditing - set a salt to include hashed username
-#idp.fticks.federation=MyFederation
-#idp.fticks.algorithm=SHA-256
-#idp.fticks.salt=somethingsecret
-#idp.fticks.loghost=localhost
-#idp.fticks.logport=514
+#idp.fticks.federation = MyFederation
+#idp.fticks.condition = MyFTICKSCondition
+#idp.fticks.algorithm = SHA-256
+#idp.fticks.salt = somethingsecret
+#idp.fticks.loghost = localhost
+#idp.fticks.logport = 514
 
 # Set false if you want SAML bindings "spelled out" in audit log
 idp.audit.shortenBindings=true
diff --git a/conf/intercept/consent-intercept-config.xml b/conf/intercept/consent-intercept-config.xml
deleted file mode 100644
index 6e899e6..0000000
--- a/conf/intercept/consent-intercept-config.xml
+++ /dev/null
@@ -1,118 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!-- Terms of Use configuration -->
-    
-    <!--
-    Terms of use is driven by a lookup function returning a key into messages/consent-messages.properties
-    
-    The default mapping returns the relying party / SP name as the key. The second example below
-    demonstrates use of a custom mapping table from the relying party name to the key to use. 
-    -->
-    
-    <alias alias="shibboleth.consent.terms-of-use.Key" name="shibboleth.RelyingPartyIdLookup.Simple" />
-    
-    <!--
-    <bean id="shibboleth.consent.terms-of-use.Key" parent="shibboleth.Functions.Compose">
-        <constructor-arg name="g">
-            <bean class="com.google.common.base.Functions" factory-method="forMap" c:defaultValue="terms-of-use">
-                <constructor-arg name="map">
-                    <map>
-                        <entry key="https://sp.example.org/shibboleth" value="example-terms" />
-                    </map>
-                </constructor-arg>
-            </bean>
-        </constructor-arg>
-        <constructor-arg name="f">
-            <ref bean="shibboleth.RelyingPartyIdLookup.Simple" />
-        </constructor-arg>
-    </bean>
-    -->
-
-    <!-- Attribute Release configuration -->
-
-    <!--
-    Attribute release whitelist, blacklist, and match expressions to determine 
-    whether consent should be obtained for an attribute based on the attribute ID.
-    -->
-    
-    <util:list id="shibboleth.consent.attribute-release.WhitelistedAttributeIDs">
-        <!--
-        <value>mail</value>
-        -->
-    </util:list>
-
-    <util:list id="shibboleth.consent.attribute-release.BlacklistedAttributeIDs">
-        <value>samlPairwiseID</value>
-    </util:list>
-
-    <!-- 
-    <bean id="shibboleth.consent.attribute-release.MatchExpression" class="java.util.regex.Pattern" factory-method="compile" 
-        c:_0="^exampleAttribute.*$" />
-    -->
-
-    <!--
-    Customize the order in which attributes are displayed.
-    Attribute IDs not present in this list will be sorted according to their
-    natural order and displayed subsequent to any attribute IDs specified here.
-    -->
-    <!--
-    <util:list id="shibboleth.consent.attribute-release.AttributeDisplayOrder">
-        <value>mail</value>
-    </util:list>
-    -->
-
-    <!--
-    These beans define mappings between audit log categories and formatting strings.
-    -->
-
-    <!--
-    For terms-of-use acceptance, the default entry is :
-     'YYYYMMDDTHHMMSSZ|TermsAccepted|jdoe|example-tou-1|rHo...rrw=|true'
-
-    For terms-of-use refusal, the default entry is :
-     'YYYYMMDDTHHMMSSZ|TermsRejected|jdoe|example-tou-1|rHo...rrw=|false'
-    -->
-    <util:map id="shibboleth.consent.terms-of-use.AuditFormattingMap">
-        <entry key="Shibboleth-Consent-Audit" value="%T|%SP|%e|%u|%CCI|%CCV|%CCA" />
-    </util:map>
-
-    <!--
-    For attribute-release consent, the default entry is :
-     'YYYYMMDDTHHMMSSZ|https://sp.example.org|AttributeReleaseConsent|jdoe|email,eduPersonAffiliation|rHo...rrw=,rHo...rrw=|false,false'
-    -->
-    <util:map id="shibboleth.consent.attribute-release.AuditFormattingMap">
-        <entry key="Shibboleth-Consent-Audit" value="%T|%SP|%e|%u|%CCI|%CCV|%CCA" />
-    </util:map>
-
-    <!--
-    Specify custom symbolic replacements for attribute names to shrink the size of results saved to client-side storage 
-    such as cookies.
-    -->
-    <bean id="shibboleth.consent.AttributeSymbolics" parent="shibboleth.consent.DefaultAttributeSymbolics" lazy-init="true">
-        <property name="sourceMap">
-            <map merge="true">
-                <!--
-                <entry key="myAttribute" value="900" />
-                -->
-            </map>
-        </property>
-    </bean>
-
-    <!--
-    Condition to evaluate to apply attribute-release consent to attribute queries.
-    -->
-    <bean id="shibboleth.consent.AttributeQuery.Condition" parent="shibboleth.Conditions.FALSE" />
-
-</beans>
\ No newline at end of file
diff --git a/conf/intercept/context-check-intercept-config.xml b/conf/intercept/context-check-intercept-config.xml
deleted file mode 100644
index aae07f0..0000000
--- a/conf/intercept/context-check-intercept-config.xml
+++ /dev/null
@@ -1,63 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!--
-    Condition to evaluate to interrupt SSO flows to check the state of the transaction before allowing.
-    
-    Typically the flow itself will be activated based on configuration in relying-party.xml, and this controls
-    whether to proceed if the flow is activated. The most common use for this flow is to check the set of
-    resolved/filtered attributes and values to see if the user is authorized or provisioned into a service.
-    -->
-    <bean id="shibboleth.context-check.Condition" parent="shibboleth.Conditions.AND">
-        <constructor-arg>
-            <list>
-                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidates="#{{'https://sp.example.org'}}" />
-                <bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"
-                        p:useUnfilteredAttributes="true">
-                    <property name="attributeValueMap">
-                        <map>
-                            <entry key="eppn">
-                                <list>
-                                    <value>*</value>
-                                </list>
-                            </entry>
-                        </map>
-                    </property>
-                </bean>
-            </list>
-        </constructor-arg>
-    </bean>
-
-    <!--
-    More general purpose approach using a Function that returns either "proceed" or a custom error Event.
-    This is a cleaner way of applying multiple conditions in different cases or triggering different events.
-    -->
-    <!--
-    <bean id="shibboleth.context-check.Function" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
-	        p:customObject-ref="shibboleth.context-check.Condition">
-        <constructor-arg>
-            <value>
-            <![CDATA[
-            var event = "proceed";
-            if (!custom.apply(input)) {
-                event = "ContextCheckDenied";
-            }
-            event;
-            ]]>
-            </value>
-        </constructor-arg>
-    </bean>
-    -->
-    
-</beans>
\ No newline at end of file
diff --git a/conf/intercept/expiring-password-intercept-config.xml b/conf/intercept/expiring-password-intercept-config.xml
deleted file mode 100644
index b3bf96d..0000000
--- a/conf/intercept/expiring-password-intercept-config.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!--
-    Condition to evaluate to determine if expiring password view should be displayed, false means to notify.
-    
-    The example uses a built-in class to evaluate an attribute containing a date/time of password expiration.
-    The format pattern parses the value and the negative offset determines how soon to warn the user beforehand.
-    -->
-    <bean id="shibboleth.expiring-password.Condition" class="net.shibboleth.idp.profile.logic.DateAttributePredicate"
-            c:attribute="passwordExpiration" c:formatString="yyyyMMddHHmmss'T'"
-            p:resultIfMissing="true" p:offset="-P14D" />
-    
-    <!-- Name of cookie to track when user was last notified. -->
-    <bean id="shibboleth.expiring-password.NotifyCookieName" class="java.lang.String" c:_0="shib_idp_exp_pwd" />
-
-    <!-- Interval (milliseconds) between notifications, default is 8 hours. -->
-    <bean id="shibboleth.expiring-password.NotifyInterval" class="java.lang.Long" c:_0="28800000" />
-    
-</beans>
diff --git a/conf/intercept/external-intercept-config.xml b/conf/intercept/external-intercept-config.xml
deleted file mode 100644
index 1d0fc29..0000000
--- a/conf/intercept/external-intercept-config.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!-- Servlet context-relative path to wherever your implementation lives. -->
-    <bean id="shibboleth.intercept.externalPath" class="java.lang.String"
-        c:_0="contextRelative:intercept.jsp" />
-
-    <!--
-    Default is to always use the path in the bean above. If you want to determine it
-    dynamically, define a bean called "shibboleth.intercept.externalPathStrategy"
-    of type Function<ProfileRequestContext,String> that returns the path to use.
-    -->
-    
-</beans>
diff --git a/conf/intercept/impersonate-intercept-config.xml b/conf/intercept/impersonate-intercept-config.xml
deleted file mode 100644
index 7dfda2b..0000000
--- a/conf/intercept/impersonate-intercept-config.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!--
-    Names of access control policies defined in access-control.xml to control impersonation.
-    The general policy runs first and determines whether to offer the impersonation option.
-    The specific policy runs second and determines whether to allow the requested impersonation.
-    -->
-
-    <bean id="shibboleth.impersonate.GeneralPolicy" class="java.lang.String" c:_0="GeneralImpersonationPolicy" />
-
-    <bean id="shibboleth.impersonate.SpecificPolicy" class="java.lang.String" c:_0="SpecificImpersonationPolicy" />
-    
-</beans>
diff --git a/conf/intercept/profile-intercept.xml b/conf/intercept/profile-intercept.xml
deleted file mode 100644
index f086cfa..0000000
--- a/conf/intercept/profile-intercept.xml
+++ /dev/null
@@ -1,42 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!--
-    Intercept flows are used at various injection points to modify processing. This is the master list
-    of flows available that provide interesting features to deployers, but flows are actually enabled by
-    specifying them in various profile configuration beans via relying-party.xml 
-    
-    This list of flows is merged with a built-in set defined in a system configuration file, and may be
-    empty, but should not be removed. You must add your own custom flows to this list if you create any.
-    -->
-    
-    <bean id="shibboleth.AvailableInterceptFlows" parent="shibboleth.DefaultInterceptFlows" lazy-init="true">
-        <property name="sourceList">
-            <list merge="true">
-                <bean id="intercept/context-check" parent="shibboleth.InterceptFlow" />
-                
-                <bean id="intercept/expiring-password" parent="shibboleth.InterceptFlow" />
-        
-                <bean id="intercept/terms-of-use" parent="shibboleth.consent.TermsOfUseFlow" />
-        
-                <bean id="intercept/attribute-release" parent="shibboleth.consent.AttributeReleaseFlow" />
-                
-                <bean id="intercept/impersonate" parent="shibboleth.InterceptFlow" />
-                
-                <bean id="intercept/external" parent="shibboleth.InterceptFlow" />
-            </list>
-        </property>
-    </bean>
-
-</beans>
diff --git a/conf/ldap.properties b/conf/ldap.properties
index d89412a..45b0be0 100644
--- a/conf/ldap.properties
+++ b/conf/ldap.properties
@@ -7,11 +7,12 @@
 ## Connection properties ##
 idp.authn.LDAP.ldapURL=ldap://localhost:10389
 #idp.authn.LDAP.useStartTLS                     = true
-#idp.authn.LDAP.useSSL                          = false
 # Time in milliseconds that connects will block
 #idp.authn.LDAP.connectTimeout                  = PT3S
 # Time in milliseconds to wait for responses
 #idp.authn.LDAP.responseTimeout                 = PT3S
+# Connection strategy to use when multiple URLs are supplied, either ACTIVE_PASSIVE, ROUND_ROBIN, RANDOM
+#idp.authn.LDAP.connectionStrategy               = ACTIVE_PASSIVE
 
 ## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust
 #idp.authn.LDAP.sslConfig                       = certificateTrust
@@ -38,11 +39,15 @@ idp.authn.LDAP.bindDN=uid=myservice,ou=system
 # for AD use idp.authn.LDAP.dnFormat=%s@domain.com
 idp.authn.LDAP.dnFormat=uid=%s,ou=people,dc=example,dc=org
 
+# pool passivator, either none, bind or anonymousBind
+#idp.authn.LDAP.bindPoolPassivator                  = none
+
 # LDAP attribute configuration, see attribute-resolver.xml
 # Note, this likely won't apply to the use of legacy V2 resolver configurations
 idp.attribute.resolver.LDAP.ldapURL=%{idp.authn.LDAP.ldapURL}
 idp.attribute.resolver.LDAP.connectTimeout=%{idp.authn.LDAP.connectTimeout:PT3S}
 idp.attribute.resolver.LDAP.responseTimeout=%{idp.authn.LDAP.responseTimeout:PT3S}
+idp.attribute.resolver.LDAP.connectionStrategy=%{idp.authn.LDAP.connectionStrategy:ACTIVE_PASSIVE}
 idp.attribute.resolver.LDAP.baseDN=%{idp.authn.LDAP.baseDN:undefined}
 idp.attribute.resolver.LDAP.bindDN=%{idp.authn.LDAP.bindDN:undefined}
 idp.attribute.resolver.LDAP.useStartTLS=%{idp.authn.LDAP.useStartTLS:true}
@@ -55,6 +60,8 @@ idp.attribute.resolver.LDAP.searchFilter=(uid=$resolutionContext.principal)
 #idp.pool.LDAP.validateOnCheckout               = false
 #idp.pool.LDAP.validatePeriodically             = true
 #idp.pool.LDAP.validatePeriod                   = PT5M
+#idp.pool.LDAP.validateDN                       =
+#idp.pool.LDAP.validateFilter                   = (objectClass=*)
 #idp.pool.LDAP.prunePeriod                      = PT5M
 #idp.pool.LDAP.idleTime                         = PT10M
 #idp.pool.LDAP.blockWaitTime                    = PT3S
diff --git a/conf/logback.xml b/conf/logback.xml
index 817de02..bf38b44 100644
--- a/conf/logback.xml
+++ b/conf/logback.xml
@@ -14,7 +14,7 @@
 
     <!-- Location and retention. -->
     
-    <variable name="idp.logfiles" value="${idp.home}/logs" />
+    <variable name="idp.logfiles" value="${idp.logfiles:-${idp.home}/logs}" />
     <variable name="idp.loghistory" value="${idp.loghistory:-180}" />
     
     <!-- Much higher performance if you operate on DEBUG. -->
diff --git a/conf/logback.xml.dist b/conf/logback.xml.dist
index 2b76770..730f583 100644
--- a/conf/logback.xml.dist
+++ b/conf/logback.xml.dist
@@ -14,7 +14,7 @@
 
     <!-- Location and retention. -->
     
-    <variable name="idp.logfiles" value="${idp.home}/logs" />
+    <variable name="idp.logfiles" value="${idp.logfiles:-${idp.home}/logs}" />
     <variable name="idp.loghistory" value="${idp.loghistory:-180}" />
     
     <!-- Much higher performance if you operate on DEBUG. -->
diff --git a/conf/logback.xml.tmp3 b/conf/logback.xml.tmp3
new file mode 100644
index 0000000..4674e93
--- /dev/null
+++ b/conf/logback.xml.tmp3
@@ -0,0 +1,191 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+
+    <!--
+    Variables for simplifying logging configuration.
+    http://logback.qos.ch/manual/configuration.html#variableSubstitution
+    -->
+
+    <!--
+    If you want to use custom properties in this config file,
+    we load the main property file for you.
+    -->
+    <variable file="${idp.home}/conf/idp.properties" />
+
+    <!-- Location and retention. -->
+    
+    <variable name="idp.logfiles" value="${idp.logfiles:-${idp.home}/logs}" />
+    <variable name="idp.loghistory" value="${idp.loghistory:-180}" />
+    
+    <!-- Much higher performance if you operate on DEBUG. -->
+    <!-- <variable name="idp.process.appender" value="ASYNC_PROCESS" /> -->
+    
+    <!-- Logging level shortcuts. -->
+    <variable name="idp.loglevel.idp" value="${idp.loglevel.idp:-INFO}" />
+    <variable name="idp.loglevel.ldap" value="${idp.loglevel.ldap:-WARN}" />
+    <variable name="idp.loglevel.messages" value="${idp.loglevel.messages:-INFO}" />
+    <variable name="idp.loglevel.encryption" value="${idp.loglevel.encryption:-INFO}" />
+    <variable name="idp.loglevel.opensaml" value="${idp.loglevel.opensaml:-INFO}" />
+    <variable name="idp.loglevel.props" value="${idp.loglevel.props:-INFO}" />
+    <variable name="idp.loglevel.httpclient" value="${idp.loglevel.httpclient:-INFO}" />
+    
+    <!-- Don't turn these up unless you want a *lot* of noise. -->
+    <variable name="idp.loglevel.spring" value="${idp.loglevel.spring:-ERROR}" />
+    <variable name="idp.loglevel.container" value="${idp.loglevel.container:-ERROR}" />
+    <variable name="idp.loglevel.xmlsec" value="${idp.loglevel.xmlsec:-INFO}" />
+
+    <!-- =========================================================== -->
+    <!-- ============== Logging Categories and Levels ============== -->
+    <!-- =========================================================== -->
+
+    <!-- Logs IdP, but not OpenSAML, messages -->
+    <logger name="net.shibboleth.idp" level="${idp.loglevel.idp}"/>
+
+    <!-- Logs OpenSAML, but not IdP, messages -->
+    <logger name="org.opensaml.saml" level="${idp.loglevel.opensaml}"/>
+    
+    <!-- Logs LDAP related messages -->
+    <logger name="org.ldaptive" level="${idp.loglevel.ldap}"/>
+
+    <!-- Logs embedded HTTP client messages -->
+    <logger name="org.apache.http" level="${idp.loglevel.httpclient}"/>
+    
+    <!-- Logs inbound and outbound protocols messages at DEBUG level -->
+    <logger name="PROTOCOL_MESSAGE" level="${idp.loglevel.messages}" />
+
+    <!-- Logs unencrypted SAML at DEBUG level -->
+    <logger name="org.opensaml.saml.saml2.encryption.Encrypter" level="${idp.loglevel.encryption}" />
+
+    <!-- Logs system properties during startup at DEBUG level -->
+    <logger name="net.shibboleth.idp.log.LogbackLoggingService" level="${idp.loglevel.props}" />
+
+    <!-- Especially chatty. -->
+    <logger name="org.apache.xml.security" level="${idp.loglevel.xmlsec}" />
+    <logger name="org.springframework" level="${idp.loglevel.spring}"/>
+    <logger name="org.apache.catalina" level="${idp.loglevel.container}"/>
+    <logger name="org.eclipse.jetty" level="${idp.loglevel.container}"/>
+
+
+    <!-- =========================================================== -->
+    <!-- ============== Low Level Details or Changes =============== -->
+    <!-- =========================================================== -->
+    
+    <!-- Process log. -->
+    <appender name="IDP_PROCESS" class="ch.qos.logback.core.rolling.RollingFileAppender">
+        <File>/tmp/logidp-process</File>
+        
+        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
+            <fileNamePattern>${idp.logfiles}/idp-process-%d{yyyy-MM-dd}.log.gz</fileNamePattern>
+            <maxHistory>${idp.loghistory}</maxHistory>
+        </rollingPolicy>
+
+        <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
+            <charset>UTF-8</charset>
+            <Pattern>%date{ISO8601} - %mdc{idp.remote_addr} - %level [%logger:%line] - %msg%n%ex{short}</Pattern>
+        </encoder>
+
+        <!-- Ignore Velocity status page error. -->
+        <filter class="ch.qos.logback.core.filter.EvaluatorFilter">
+            <evaluator>
+                <matcher>
+                    <Name>VelocityStatusMatcher</Name>
+                    <regex>ResourceManager\s*: unable to find resource 'status\.vm' in any resource loader\.</regex>
+                </matcher>
+                <expression>VelocityStatusMatcher.matches(formattedMessage)</expression>
+            </evaluator>
+            <OnMatch>DENY</OnMatch>
+        </filter>
+    </appender>
+
+    <appender name="ASYNC_PROCESS" class="ch.qos.logback.classic.AsyncAppender">
+        <appender-ref ref="IDP_PROCESS" />
+        <discardingThreshold>0</discardingThreshold>
+    </appender>
+
+    <appender name="IDP_WARN" class="ch.qos.logback.core.rolling.RollingFileAppender">
+        <!-- Suppress anything below WARN. -->
+        <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+            <level>WARN</level>
+        </filter>
+        
+        <File>/tmp/logidp-warn</File>
+        
+        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
+            <fileNamePattern>${idp.logfiles}/idp-warn-%d{yyyy-MM-dd}.log.gz</fileNamePattern>
+            <maxHistory>${idp.loghistory}</maxHistory>
+        </rollingPolicy>
+        
+        <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
+            <charset>UTF-8</charset>
+            <Pattern>%date{ISO8601} - %mdc{idp.remote_addr} - %level [%logger:%line] - %msg%n%ex{full}</Pattern>
+        </encoder>
+        
+        <!-- Ignore Velocity status page error. -->
+        <filter class="ch.qos.logback.core.filter.EvaluatorFilter">
+            <evaluator>
+                <matcher>
+                    <Name>VelocityStatusMatcher</Name>
+                    <regex>ResourceManager\s*: unable to find resource 'status\.vm' in any resource loader\.</regex>
+                </matcher>
+                <expression>VelocityStatusMatcher.matches(formattedMessage)</expression>
+            </evaluator>
+            <OnMatch>DENY</OnMatch>
+        </filter>
+    </appender>
+    
+    <!-- Audit log. -->
+    <appender name="IDP_AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
+        <File>/tmp/logidp-audit</File>
+
+        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
+            <fileNamePattern>${idp.logfiles}/idp-audit-%d{yyyy-MM-dd}.log.gz</fileNamePattern>
+            <maxHistory>${idp.loghistory}</maxHistory>
+        </rollingPolicy>
+
+        <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
+            <charset>UTF-8</charset>
+            <Pattern>%msg%n</Pattern>
+        </encoder>
+    </appender>
+    
+    <!-- Consent audit log. -->
+    <appender name="IDP_CONSENT_AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
+        <File>${idp.logfiles}/idp-consent-audit.log</File>
+
+        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
+            <fileNamePattern>${idp.logfiles}/idp-consent-audit-%d{yyyy-MM-dd}.log.gz</fileNamePattern>
+            <maxHistory>${idp.loghistory}</maxHistory>
+        </rollingPolicy>
+
+        <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
+            <charset>UTF-8</charset>
+            <Pattern>%msg%n</Pattern>
+        </encoder>
+    </appender>
+
+    <!-- F-TICKS syslog destination. -->
+    <appender name="IDP_FTICKS" class="ch.qos.logback.classic.net.SyslogAppender">
+        <syslogHost>${idp.fticks.loghost:-localhost}</syslogHost>
+        <port>${idp.fticks.logport:-514}</port>
+        <facility>AUTH</facility>
+        <suffixPattern>[%thread] %logger %msg</suffixPattern>
+    </appender>
+
+    <logger name="Shibboleth-Audit" level="ALL">
+        <appender-ref ref="${idp.audit.appender:-IDP_AUDIT}"/>
+    </logger>
+
+    <logger name="Shibboleth-FTICKS" level="ALL" additivity="false">
+        <appender-ref ref="${idp.fticks.appender:-IDP_FTICKS}"/>
+    </logger>
+
+    <logger name="Shibboleth-Consent-Audit" level="ALL">
+        <appender-ref ref="${idp.consent.appender:-IDP_CONSENT_AUDIT}"/>
+    </logger>
+    
+    <root level="${idp.loglevel.root:-INFO}">
+        <appender-ref ref="${idp.process.appender:-IDP_PROCESS}"/>
+        <appender-ref ref="${idp.warn.appender:-IDP_WARN}" />
+    </root>
+
+</configuration>
diff --git a/conf/metadata-providers.xml b/conf/metadata-providers.xml
index fc81612..d5cb34b 100644
--- a/conf/metadata-providers.xml
+++ b/conf/metadata-providers.xml
@@ -18,7 +18,8 @@
                         http://www.w3.org/2000/09/xmldsig# http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd
                         http://www.w3.org/2009/xmldsig11# http://www.w3.org/TR/2013/REC-xmldsig-core1-20130411/xmldsig11-schema.xsd
                         http://www.w3.org/2001/04/xmlenc# http://www.w3.org/TR/xmlenc-core/xenc-schema.xsd
-                        http://www.w3.org/2009/xmlenc11# http://www.w3.org/TR/2013/REC-xmlenc-core1-20130411/xenc-schema-11.xsd">
+                        http://www.w3.org/2009/xmlenc11# http://www.w3.org/TR/2013/REC-xmlenc-core1-20130411/xenc-schema-11.xsd"
+    sortKey="1">
 
     <!--
     Below you place the mechanisms which define how to load the metadata for SP(s) you will
@@ -41,7 +42,7 @@
     Get the public key certificate from the party publishing the metadata, and validate
     it with them via some out of band mechanism (e.g., a fingerprint on a secure page).
 
-    The EntityRoleWhiteList saves memory by only loading metadata from SAML roles
+    The EntityRole filter saves memory by only loading metadata from SAML roles
     that the IdP needs to interoperate with.
     -->
     
@@ -49,11 +50,12 @@
     <MetadataProvider id="HTTPMetadata"
                       xsi:type="FileBackedHTTPMetadataProvider"
                       backingFile="%{idp.home}/metadata/localCopyFromXYZHTTP.xml"
-                      metadataURL="http://WHATEVER"> 
+                      metadataURL="http://WHATEVER"
+                      failFastInitialization="false">
         
         <MetadataFilter xsi:type="SignatureValidation" certificateFile="%{idp.home}/credentials/metaroot.pem" />
         <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P30D"/>
-        <MetadataFilter xsi:type="EntityRoleWhiteList">
+        <MetadataFilter xsi:type="EntityRole">
             <RetainedRole>md:SPSSODescriptor</RetainedRole>
         </MetadataFilter>
     </MetadataProvider>
diff --git a/conf/relying-party.xml b/conf/relying-party.xml
index 5045b93..439e7f1 100644
--- a/conf/relying-party.xml
+++ b/conf/relying-party.xml
@@ -27,20 +27,17 @@
         </property>
     </bean>
 
-    <!--
-    Default configuration, with default settings applied for all profiles, and enables
-    the attribute-release consent flow.
-    -->
+    <!-- Default configuration, with default settings applied for all profiles. -->
     <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
         <property name="profileConfigurations">
             <list>
                 <!-- SAML 1.1 and SAML 2.0 AttributeQuery are disabled by default. -->
                 <!--
-                <bean parent="Shibboleth.SSO" p:postAuthenticationFlows="attribute-release" />
+                <bean parent="Shibboleth.SSO" />
                 <ref bean="SAML1.AttributeQuery" />
                 <ref bean="SAML1.ArtifactResolution" />
                 -->
-                <bean parent="SAML2.SSO" p:postAuthenticationFlows="attribute-release" />
+                <bean parent="SAML2.SSO" />
                 <ref bean="SAML2.ECP" />
                 <ref bean="SAML2.Logout" />
                 <!--
@@ -61,7 +58,7 @@
         for SAML 2 SSO without encryption. This is a common "vendor" scenario.
         -->
         <!--
-        <bean parent="RelyingPartyByName" c:relyingPartyIds="https://sp.example.org">
+        <bean id="ExampleSP" parent="RelyingPartyByName" c:relyingPartyIds="https://sp.example.org">
             <property name="profileConfigurations">
                 <list>
                     <bean parent="SAML2.SSO" p:encryptAssertions="false" />
diff --git a/conf/services.properties b/conf/services.properties
index 6edb015..8150d3a 100644
--- a/conf/services.properties
+++ b/conf/services.properties
@@ -15,7 +15,7 @@ idp.service.logging.checkInterval = PT5M
 #idp.service.relyingparty.resources = shibboleth.RelyingPartyResolverResources
 #idp.service.relyingparty.failFast = false
 idp.service.relyingparty.checkInterval = PT15M
-# Set true to limit metadata-driven settings lookup to decoded EntityAttributes
+# See MetadataDrivenConfiguration wiki topic for details
 idp.service.relyingparty.ignoreUnmappedEntityAttributes=true
 
 #idp.service.metadata.resources = shibboleth.MetadataResolverResources
@@ -25,7 +25,6 @@ idp.service.relyingparty.ignoreUnmappedEntityAttributes=true
 #idp.service.metadata.enableByReferenceFilters = true
 
 #idp.service.attribute.registry.resources = shibboleth.AttributeRegistryResources
-#idp.service.attribute.registry.namingRegistry = shibboleth.DefaultNamingRegistry
 #idp.service.attribute.registry.failFast = false
 idp.service.attribute.registry.checkInterval = PT15M
 # Default control of whether to encode XML attribute data with xsi:type
diff --git a/conf/services.xml b/conf/services.xml
index 350f298..24e2b1e 100644
--- a/conf/services.xml
+++ b/conf/services.xml
@@ -11,16 +11,13 @@
                                
     <!-- By default we look at resources whose names are derived from %{idp.home}. -->
 
-    <!-- This set of resources supports a native Spring relying-party.xml file. -->
     <util:list id="shibboleth.RelyingPartyResolverResources">
         <value>%{idp.home}/conf/relying-party.xml</value>
         <value>%{idp.home}/conf/credentials.xml</value>
-        <value>%{idp.home}/system/conf/relying-party-system.xml</value>
     </util:list>
 
     <util:list id="shibboleth.MetadataResolverResources">
         <value>%{idp.home}/conf/metadata-providers.xml</value>
-        <value>%{idp.home}/system/conf/metadata-providers-system.xml</value>
     </util:list>
 
     <util:list id ="shibboleth.AttributeResolverResources">
@@ -33,7 +30,6 @@
     -->
     <util:list id ="shibboleth.AttributeRegistryResources">
         <value>%{idp.home}/conf/attribute-registry.xml</value>
-        <value>%{idp.home}/system/conf/attribute-registry-system.xml</value>
         <value>%{idp.home}/conf/attributes/default-rules.xml</value>
         <value>%{idp.home}/conf/attribute-resolver.xml</value>
     </util:list>
@@ -44,16 +40,10 @@
 
     <util:list id ="shibboleth.NameIdentifierGenerationResources">
         <value>%{idp.home}/conf/saml-nameid.xml</value>
-        <value>%{idp.home}/system/conf/saml-nameid-system.xml</value>
     </util:list>
     
     <util:list id="shibboleth.AccessControlResources">
         <value>%{idp.home}/conf/access-control.xml</value>
-        <value>%{idp.home}/system/conf/access-control-system.xml</value>
-    </util:list>
-
-    <util:list id="shibboleth.CASServiceRegistryResources">
-        <value>%{idp.home}/conf/cas-protocol.xml</value>
     </util:list>
 
     <!--
@@ -63,7 +53,6 @@
     -->
     <util:list id="shibboleth.MessageSourceResources">
         <value>%{idp.home}/messages/messages</value>
-        <value>%{idp.home}/system/messages/messages</value>
     </util:list>
     
 </beans>
diff --git a/conf/session-manager.xml b/conf/session-manager.xml
deleted file mode 100644
index 7372029..0000000
--- a/conf/session-manager.xml
+++ /dev/null
@@ -1,29 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-    xmlns:context="http://www.springframework.org/schema/context"
-    xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
-    xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
-    default-init-method="initialize"
-    default-destroy-method="destroy">
-
-    <!-- Flows that propagate logout to additional services using supported protocols. -->
-    <util:list id="shibboleth.LogoutPropagationFlows">
-        <ref bean="logoutprop/cas" />
-        <ref bean="logoutprop/saml2" />
-    </util:list>
-        
-    <!--
-    List of client-side storage service plugins. If you use server-side storage and don't need these
-    services, you can remove or comment out the <ref> elements, but don't remove the list bean or
-    a default list will be substituted for backward compatibility.
-    -->
-    <util:list id="shibboleth.ClientStorageServices">
-        <ref bean="shibboleth.ClientSessionStorageService" />
-        <ref bean="shibboleth.ClientPersistentStorageService" />
-    </util:list>
-    
-</beans>
diff --git a/credentials/idp-backchannel.crt b/credentials/idp-backchannel.crt
index c8886ea..a4d86af 100644
--- a/credentials/idp-backchannel.crt
+++ b/credentials/idp-backchannel.crt
@@ -1,25 +1,25 @@
 -----BEGIN CERTIFICATE-----
-MIIEKDCCApCgAwIBAgIVAIsUgQNNYuil54yiVLUFlzdr/qQUMA0GCSqGSIb3DQEB
-CwUAMBoxGDAWBgNVBAMMD2lkcC5leGFtcGxlLm9yZzAeFw0yMDAyMDYxNzE5NTRa
-Fw00MDAyMDYxNzE5NTRaMBoxGDAWBgNVBAMMD2lkcC5leGFtcGxlLm9yZzCCAaIw
-DQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAOSJwBSKrIMjDCdjxHYxQ0YGz56h
-Vqb/DklBpsOeOgXnFMPoDf941IDu2kOvCpRKW12wWmDUskv9Vi+4RfiA9gUXUCdh
-jHTNBUj9GXYafCFFMReZ/fVbqvSRHCE/EBHHjo2qAHTfw/R0P8IBdAICs1LvkzCn
-W3prZJnJH3HD3+W/yubesNe5cG3/D9OnAeNMcwtNh7fyuGIFzUL1OA/pL0Gu+UXx
-W0sMjOPR4Tlt0yi1k2tsZGmB6AYMqX2Wjd/nhjTibqGEVC0OSRiDtr/C8nEx5MAD
-bl23mzHR8S/9vxQN8Y9N78FtObnMcB5PPtkkJsqBPpAlDiz2ONT27AnTM6EsaBjc
-VG3PH7Js7SSEvJPuibTfxIOWcLmVVSt6RozMSclXpvq2I9l35hoCq+OaoF+RXbSO
-8gaon5NYbCfWVSpbmKbw1o/wcOqsrM1F/4mtZp3T5VMYOZBARXlewwkh+xm0p5JB
-lmJO8x9WOIiQFjiPZKkK63GR5OgO5RwD5O3U4wIDAQABo2UwYzAdBgNVHQ4EFgQU
-3ztcEnBpdG+CgScY9MC0g81oOVcwQgYDVR0RBDswOYIPaWRwLmV4YW1wbGUub3Jn
-hiZodHRwczovL2lkcC5leGFtcGxlLm9yZy9pZHAvc2hpYmJvbGV0aDANBgkqhkiG
-9w0BAQsFAAOCAYEAAsszcNm8lHWf31vwbNGY8m6Oz6XXrhYAmRcudvs86z2bWw3C
-oDLvKWFuyJAAeIP11UpbW4aSs+P2f4I9/ZfTVbqKxPfSYIG1LSdKl5ICFaGP18K6
-PBqtu6eu71Hrz083IvR8qddD7Kl12aGfwDhFUtqy2zhmYsI7LhfwRA8ayJX4204x
-tOmU6LxRtgJWsdlqjyzcZ9buafqfvoTCbjnzbO2gUoEPCDUxfTi+HRn+JppXVxzV
-vXbs9G5xWI6eeojYtZqKWn3xaLQcPcla2b0dJSYvZ0paoC44hpwr5eWX2mGQ5+cn
-AzK55H3uOq975QJDIdXpuuWIh99y+jC8/NcUFkFjb/86DSOs+LtwM2VhjiL5HL3I
-oVIuAVBS4YAxE8NDGgcuPrS7+m1UjnHiagOkEqbhMr0/j16/g++CivWpWPxjTYfL
-Rbw85j+b7/uzUTYXzQgVpSnvgB6cP92MH3WNWyIYf+d/mribIybrKpE65diSVUYC
-vwiLfazt2AHOsVki
+MIIEJzCCAo+gAwIBAgIUEtJU0oOkMid5473At++VFGAbX3gwDQYJKoZIhvcNAQEL
+BQAwGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUub3JnMB4XDTIxMDMyNDE1NTQyNFoX
+DTQxMDMyNDE1NTQyNFowGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUub3JnMIIBojAN
+BgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAq+6x7Ay8s9vl/r+trvJMbwdXiFxH
+PwQeJ/Oof48EWuP61zluBENhk9E5rdf2zlCxkfiB78G8YFZh9ZjcWkIR63xIO9YA
++NuQg+WOPu8fvegcly0ulg2dRXvi0b7q/FsK1MtKcxRECpTNu2DD6K5oHkjf/nmp
+nJIlAxvYyP0aqwEy+qq1NFC+WTjoFP7ZyKt+oSz08ONV2v/1dNRwcjfgc8MJcoq0
+Nw56mGZ2LlTidXP8lQBpsQ6/gJvdnVv/B4q8fVS3zpFgokkyQM6eW1ZpGjPY9K1A
+paLcAio+MCoPbRJwAlI+5tdgKMMvz+xq4RN0e68IIZS4IgmkVem52uJcfUiX297F
+Ar1QdH4NZvijir2Wt4xYMxpThsV6n7F88wWzJj/D5bErZeIWG+DWJq2FZ7rqq3Oc
+tz22TH3iBkYrSvFG5nwyHQJaptDDMm6OpWTfmcjh9jT9H6mz4BdBln2uJUswVNGG
+bR9w9OcXqYN6X8bll9Q9XcVZh2uBgPB3NWGzAgMBAAGjZTBjMB0GA1UdDgQWBBTc
+BIECuv3b1y5K9FBK2zKFc2j4HzBCBgNVHREEOzA5gg9pZHAuZXhhbXBsZS5vcmeG
+Jmh0dHBzOi8vaWRwLmV4YW1wbGUub3JnL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3
+DQEBCwUAA4IBgQAQsx5PLHRi8+WjBTSW6RiNiSRFTpNKPdFzoKDhpaCVSlrpjgzp
+0qD7QorlKPVJNUhl56Fs2S6oWy6e7lb1eBPBAfCNqTalFJNnDdMvZh02FCecbE87
+6Wv7JcD5kA+f6HUDwmaB15fabheSE3YMGQFtaEidmd/jd23CaDL5RNeHUoKS6JHC
+yNsUlZ+R0Cq2ia2wLhW2Z2CYpNh9JM/LOmcTslOgmThNeCnrMIikWSTLQ4C3H9/R
+/iN8NaQhKn4vcYTwEqiaVFQbIU2mQQLT+YK63L4S4S339IsjZiqGEw8DKBnfjL7b
+D1snXa+G6MiQJNcuChuvGfGSlXCSFjtUr9vivzHeGW2h+6uStzTuZ7t5NhQMRTFD
+qT+gyCR/bzsEUh1Lj3J2mFPM/cUSlhH3H0TJcVT9GZUzFNAP0qbaFs9PxXH2gpDI
+XrshYcEiXlj+dsSUNhaCqYibPwkHrRBIAqoDGdMFI+Y5SePVo4ksA55m0gPeY+FM
+mUbCNQngUzNlYPU=
 -----END CERTIFICATE-----
diff --git a/credentials/idp-backchannel.p12 b/credentials/idp-backchannel.p12
index f39cfa8..9e30c3d 100644
Binary files a/credentials/idp-backchannel.p12 and b/credentials/idp-backchannel.p12 differ
diff --git a/credentials/idp-encryption.crt b/credentials/idp-encryption.crt
index f834a3c..10fa34d 100644
--- a/credentials/idp-encryption.crt
+++ b/credentials/idp-encryption.crt
@@ -1,25 +1,25 @@
 -----BEGIN CERTIFICATE-----
-MIIEKDCCApCgAwIBAgIVAJ9U0+AO1v0VbDiaql+oeEssbFCYMA0GCSqGSIb3DQEB
-CwUAMBoxGDAWBgNVBAMMD2lkcC5leGFtcGxlLm9yZzAeFw0yMDAyMDYxNzE5NTRa
-Fw00MDAyMDYxNzE5NTRaMBoxGDAWBgNVBAMMD2lkcC5leGFtcGxlLm9yZzCCAaIw
-DQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAJyOGdr38pJc2pEZe+YcJSoo3ym2
-oP/5M2jW2mT2oJO13qrcTcBZi+x8/g+3wJmmJxX7BACnSquY2FZ0eDJl0rADInTO
-MihxesnjSVo9t8f63hTJ5SEpqM70NnanOcEbJuNQCr3ZRxXjD2Xnoiql1wY7EcDY
-S2B4LWNU41ruqZcZAitTHA9jIA2+jmIGjqKSh1mBmFqN4fVUQICW4NExfedIyo+L
-H4wijFi3W4wFdqYONYmXlxpG03fRokOplsFjwDoxLKR5h5lNnyd/vjQ6Prx+vedu
-FfdAt1TGAPJ6DXUtoPVpyajP6WZK96jXM7uaHlQ/uLMQQwJN7nzfvKobCLylHRre
-Y2aov0JOEAqMd5X9L7xPcB+DjKkhaUBowS+qb50SNK87eejpZQS8BEhQ9Xi/jHnJ
-T8tn9vL39NDwvCYu6vdpiY5kexKZ6WvVK3NltkUzaKMuvfULmHy2pg1ro30Wwb4+
-rOfwvLkE4UZdg07JyP94obkRVxh9uBliAqvDtQIDAQABo2UwYzAdBgNVHQ4EFgQU
-zOMLGuvLojqNEvGDS8IddKPwM/cwQgYDVR0RBDswOYIPaWRwLmV4YW1wbGUub3Jn
+MIIEKDCCApCgAwIBAgIVAPyKe4kuv7ZzU9YkyhDT6PWudYj5MA0GCSqGSIb3DQEB
+CwUAMBoxGDAWBgNVBAMMD2lkcC5leGFtcGxlLm9yZzAeFw0yMTAzMjQxNTU0MjNa
+Fw00MTAzMjQxNTU0MjNaMBoxGDAWBgNVBAMMD2lkcC5leGFtcGxlLm9yZzCCAaIw
+DQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAL+i5PmO/JsPcM25CSY0zJeJ+rim
+4mqlr0sT7BRIEEv6ja9RAxRI3fRXOYfz6PxfF6AMsYy35bCueOAOcbr5IyCIhHiu
+HemT3ieiROoOUY3P0D4KdwC3cSxANc53pEIVsNd05Xxe2mVnGJ9liomWGl0Zsj4v
+TC6f7PFjAEV3JyaETMyLpKVH9rt9FVKPZ3zl9FN/nqA0KodjQVbJYjIyJsib3WBB
+WWZ6VgwErHQriCk2gIGrYbltcZe3ujKOpNaRiIraG1VPs/YaP0IcsPekS0Vy9qcF
+6Xq4xErWdR+Fh0v5iI6bZ3feKnGDO1q30M5I/cfkwW9CQd9zqLjM38MilFJYCoqI
+KbZRPvvKAt1B/JZJMhZZJaBy9y5CtTHnZiEZxdovz1R8BsZgmYgMRfIqTAN3+bYl
+kzfgaS/PmQkiY+iUzsi7Bi753Eqlaksa1xqeV7tkpVRDOUeTMOvjBzueQS1wdP7i
+VgiQrWF+EqBBxGY6QqlYdPbOZOwcL8nOE6+BwwIDAQABo2UwYzAdBgNVHQ4EFgQU
+N1YcXFUpP/ioF9ByIell/FLIxCIwQgYDVR0RBDswOYIPaWRwLmV4YW1wbGUub3Jn
 hiZodHRwczovL2lkcC5leGFtcGxlLm9yZy9pZHAvc2hpYmJvbGV0aDANBgkqhkiG
-9w0BAQsFAAOCAYEAC+KIjwmRVTPwbzvwkYum1ZCjBL99Z4T+rvFtYM9HWWZQqKo/
-YmQIF/bYtf6IzU2ayQXd77Wrm4gfJYXvIdLqpj3oE1+kBeZ+XJ1/sn9Rp7qw4int
-pyPZ9W+j+/IAD2OVs6ykbU32QnIrKYAotgIygwKTpzpkg+peuzQ1l/duCCT4m7Re
-e9RHjKfrp+pRwBG8ppTE2EupCkJV+wIokZCn1kepDJ+E1CodofVAIUuXkX9yAwz5
-eqfLj2VNIpHLHNi8U/LSutwOYTuulBdPWvjYQ8wZZoE4JId4K5u6wvMwbhpDad0e
-kar1XJR8zFBi63smQ3CJ/7jUCbanESVAs3U9S5o12Bl9sfQsAxz4icLhhHgEGAV1
-UhpcGn83CI/hWp/swjEVstIxlrQOpr9nd3G3zLSrTS6TRiBMMfVV/wkwnhBFfUaM
-cWp5+Rt6wo05o8+njQ2QETsFt8kP5SImFg5YNatqiXPrtlY6PBULB8yOil8mX4Bi
-OK0/vM0ibCFaRAzB
+9w0BAQsFAAOCAYEAq3MFr90wgCFV2fUdxACwnytfK3tlpT7bczA4ks3iUlMM2o8t
+QuaMe5pru+5nhMk+D8Be3RoIIks/ddxHwVKbwLjzJFEG/9S43MduXP6P3weMr0Y8
+lIqZrd65uaaEbAd0ldGSn6ekB+ERwDNC2aYghwMIPqyCvQo6vLRsBsnLEa3q63Xr
+GYbkCawtvMTINYxAgFP0vavxNXF7A9qqDCpS/m4QgdbL7DLEJTN/wCgJVPTA9f9M
+SyjcmSRJ2FMNHyRgor26jT0rCeUNJ1MgM0kA3hwqW5eK+nj9OZWWVjOZaAkdVRn1
+mGJoRmtK/dGE4SEXfyIgWqQfdGOpIAEkIG9EHaH37Kg+slMjb/ZwN/riShIxPacT
+YPkAC/AqRaiJOzvi4ZB9OtjC3wyoyak5e33p5DnCIQ2+hEbebAsnYWP6Yf/c1KMw
+1Z56FlQwmY1yBZ6+yTIR0jCKWj5mFuahsDW7VSkRUBmt55Q/o24YbHfLioYRSJAi
+uADV9N9NCGawgJnf
 -----END CERTIFICATE-----
diff --git a/credentials/idp-encryption.key b/credentials/idp-encryption.key
index 9fec9ff..b8ed07c 100644
--- a/credentials/idp-encryption.key
+++ b/credentials/idp-encryption.key
@@ -1,39 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIG5AIBAAKCAYEAnI4Z2vfyklzakRl75hwlKijfKbag//kzaNbaZPagk7XeqtxN
-wFmL7Hz+D7fAmaYnFfsEAKdKq5jYVnR4MmXSsAMidM4yKHF6yeNJWj23x/reFMnl
-ISmozvQ2dqc5wRsm41AKvdlHFeMPZeeiKqXXBjsRwNhLYHgtY1TjWu6plxkCK1Mc
-D2MgDb6OYgaOopKHWYGYWo3h9VRAgJbg0TF950jKj4sfjCKMWLdbjAV2pg41iZeX
-GkbTd9GiQ6mWwWPAOjEspHmHmU2fJ3++NDo+vH69524V90C3VMYA8noNdS2g9WnJ
-qM/pZkr3qNczu5oeVD+4sxBDAk3ufN+8qhsIvKUdGt5jZqi/Qk4QCox3lf0vvE9w
-H4OMqSFpQGjBL6pvnRI0rzt56OllBLwESFD1eL+MeclPy2f28vf00PC8Ji7q92mJ
-jmR7Epnpa9Urc2W2RTNooy699QuYfLamDWujfRbBvj6s5/C8uQThRl2DTsnI/3ih
-uRFXGH24GWICq8O1AgMBAAECggGAPFWDX2EZKhEA5tSkbD1CkWno/2Fz0NKQXoIW
-7rwhjGuV4dE/Ybbg9wYAv7v4TP68p3rywvG2FEW2cjM2s22McerzV4Kzz+RUBwRC
-G7YXYsmq1uYsGMi+VuvFJZsy5dn59ba+PQZEoAm+wG4xkDATm0IeiGyTOB14mIR5
-jmzWDPZFYL8J3GA+VS2wH9UZGUxRP0xzk8qEX5DVvvjmsZhaRk1GS2W5hb82yWX4
-sRDV9g8Z0OoMAMN08gNnfp4YDHXNX70NKxsmxaGkJOz/7VB3pF43iv+hp0Vmcc5t
-3MjbBHnnPY9g229g9fMEbbDzu4wvLA3XvG2ExF+cDEumX1KdtjoeFJXke7mi3tIp
-2xlSaDpDIc4dQDvIWnxpkkRXGh+QDWlaZJTPW7Ju6IATa9w9FYsDO90g1G1ezqMW
-emZkzzTi3UnBhZUmtNF14tIT+1PjGPjnTq+9EukDHTetNBcnX1ozv7huzeo76utq
-69oiorLK2YAAayC7k+/HX4iDNvvNAoHBANW0HaQ50Nr7Xq0kbVdV5p+zO9pxhIc9
-gBQGuzMGXU1jbT0j5rIglGfZMLWaqyMEw6ek9kF1azyY6ozjDb5a4+OHCd5JLeh3
-BmAufbosrYT0/yF5mDXb4zGuS2ZD2tlWBhed1MgK5KSTIF2tfMusA2n4DBNkVOsV
-J1Jf4Sd09fYNbEVB/MDYvVHgvXIaovmkQz9rlOWdy0XigxGlIiEledE1YaTSOUVU
-J9sshdt+JnULPG+qqWkEQTdcatlGTccN6wKBwQC7imX0Vgi78gEp+nMRaWW3ZdYv
-lA0dmQk5YTSV9XLcYVmaTic1uinFgwjbKPoxbAsi29qTClCAPhulY/2ixdw01o3F
-ei+rMiwaPBtrFyF43dQlNPJ0cbQBTyJI44pUcA+WKhdfN0X4KyTyzUFmAR8AiZq+
-gu80ToVu454nGQoH73GO4sAGnR8GxSpZ1jIatBNsUHmlwblRsoZhIzAaKlXWjnF2
-dVXiEk+BdsqdWSZKjS6hWeVEJnAm+OhOBp3W7N8CgcEAm+pgofwItGwnxD1KhSjI
-LYYwSgz+e0lUk8fhdrXTBu5euffijd2VSTs9/ZGOAOut8Dc778BCcCDFJ+tUkKhx
-kgRpH8PWeb+1aCEjW9zS8KlrJzo24jy+wvV+T2t8VYscwMhHgXfpH2W0fIRiA5tJ
-llwCO3e9ORLi8IfBlu8PsOhUMSeWyACaCA3nSkPC2k6NPc05Alog/6jmpc4MW5Cj
-Ew9WYVF7tWhT9+XA98ZPOp/rBTHHjjYrer+zuThA8NTnAoHATzEf4E88HPESIMHL
-OT0CYLE2Ap1H9Imc5YfwhqpAuGK7TXdXA077OJYedT0WeSwgf7XK1HB0kdKoJezV
-O5jFZeJ7tznjSy1Chkl/YndAASPa42M6RoWE91CNL641yXYQft6DRAe5GhRN4+Fc
-jlBG4Rk6KNxtWe8WVT70l5nxLGylzSpe3+wVH+y993WFbtU/pmtNEvt838y9BeOv
-+jyKRrGbo+PkQjRtMkQRRuRQUQbQ+/1T3LVGgo50ug39NLaNAoHBAK5d0JIkk5/j
-QqJaFwIp2hnPHHIRb8BCtrIBzjzEU3jZ4AlVgMeRhdkObyZqSr0MQ5jiCKQR/mVr
-u7biW26CSbcF3+mj6aFYzeSXr2QIKQRnZtdBOcyTDnRLlWSe8Z4e4C888YuFF0gf
-Nnh0XrKdEUMuc6QeHtm//5X14nGj5noqm9lRYmQ/hk114Vxn5CEphCZOlxZwYVX4
-WcZ+73VyJ/E5W9zXEIqcNbtzvHfSOeOXKl1Rsgh6QHpsO0GrMbFD5A==
+MIIG5QIBAAKCAYEAv6Lk+Y78mw9wzbkJJjTMl4n6uKbiaqWvSxPsFEgQS/qNr1ED
+FEjd9Fc5h/Po/F8XoAyxjLflsK544A5xuvkjIIiEeK4d6ZPeJ6JE6g5Rjc/QPgp3
+ALdxLEA1znekQhWw13TlfF7aZWcYn2WKiZYaXRmyPi9MLp/s8WMARXcnJoRMzIuk
+pUf2u30VUo9nfOX0U3+eoDQqh2NBVsliMjImyJvdYEFZZnpWDASsdCuIKTaAgath
+uW1xl7e6Mo6k1pGIitobVU+z9ho/Qhyw96RLRXL2pwXperjEStZ1H4WHS/mIjptn
+d94qcYM7WrfQzkj9x+TBb0JB33OouMzfwyKUUlgKiogptlE++8oC3UH8lkkyFlkl
+oHL3LkK1MedmIRnF2i/PVHwGxmCZiAxF8ipMA3f5tiWTN+BpL8+ZCSJj6JTOyLsG
+LvncSqVqSxrXGp5Xu2SlVEM5R5Mw6+MHO55BLXB0/uJWCJCtYX4SoEHEZjpCqVh0
+9s5k7Bwvyc4Tr4HDAgMBAAECggGBAIQTUJxu38o+qhAfJx8d5KPMhPAelI3MAzRL
+VrnjsNesp1ndC7I/RjnQo+X/ROQq5a15EiVZ2QQcO1KwodGrQ3p4nFRQLG1/a+0E
++VoW5D5Iq80WiU4FIArPdkYGTz78lBTqi/9boEmi9GVnJkQNH75qp14UWv0HW9ZB
+1T4LEQCKziNrWt5O6s3tN3TfQQPjuLCTlE/1pBoLXkziHrtZtUEtqzVb1LG8PvGp
+hvHJzt4Yohi8dW3G8DMQfVO63ADF65OwjaMO4SmU/lbRDqJSvb4LxRiahRasBLYC
+qoqi53Y3grDiZMVd6XAnDrr12JzsgGDj2/j4GiMHSQKkPBMcy+SQpiVYV2jFiaGn
+31vJufShqP+70Vez+1DVwjj9Gf/R/3zipib9q8sz7UDkpi2Du5I2mX4K5uEmx9Aw
+hkZoqIM+yHegfDSIwCqHqNqh7mHOwHOmOAgFqkY2DNyTpA513iIUzggQ1pNKsg+d
+cLljbubz7KppNApcTBaZUSGy7KzFAQKBwQDnKoxT1feWZhsDPOFa474sebHfpsMK
+vlvnEUzG4UvBz/QqR8ib7BsT2ZuF90lo+NTDg6Wohn5J/gTc6z0J5SBhjDay21a4
+qaGTA2BZL6D1el3yBTI0dK9AA/1UaNGQN1MUNmHEXlxFuAh6KEEbau0qNNgxJXpQ
+90FzQaonHdstGRj49iHbX1xO28AYlRkYFzraR9u1M8wFcWnVpoJ8nHP3LH/Qwq3m
+8ov63Jl9YkxPgvOnZb3Irj3Pz20CIgBWUPkCgcEA1Dk1ewLqkxYgMEcRnGGyF489
+3K88pe28/HCL7qWUuIHyHHnym10S0qRHxApTPKhpJS7L/h46lqFfPuxvLHLfB8I+
+uXxq4TKHVRbLHxbcC6h7oHJS5Ezi+PCIFP8nINJ97wq7OWaPVn388MU8sA9khy5j
+gsyPoRj8QnJrWi37j6RFJWoYiCwFRRtCzhMRJUafuOba865h2wXUZwhfMPCuhA4u
+go5621Sld/RD9PajGsfiGx/5uMdtdvPwDzLXOhObAoHBANUKI1VIBes3ooFzZASN
+isAWT1VcrLeEA9KJ4QYQr+6oJc+pZDo+eB3tGCV4ZtE1MXAWLV+Iw26Rig3HRfOO
+lC8SN37SIbQBsQR5whuvh1l0MoxPOZuaRcBrbNaT2z5bnlcsXyHIDKW8GyPpYUdR
+Xczd8rgoX/eqR0lfJN7z5wBC9v7KZx1zXvDWGM0O65eGIRj1zIfMeqQxh2X9FJie
+30jWW90a7YW/1j2VfGdPZiCJAOAvJZ6C5jhUY5PpngHukQKBwQCk7Qy920dXJWPA
+gQqToGzZ2Ez4Gwsj3Dz5ZbGpte588Sepr6+1w8AkCN1o4alMQ4jrB5Iqm21msGQn
+r3C6d08SZYd/eMxK1IzNuJgEQiyhtr7UsuPuXj4pvivTPXM4E70grxNPCYAtdF3E
+81M1c9DpKUjWVojsZlFshiUdgQy11bCS4f/Mm4FA8m2ZXsH9WQQ5mtbfd06++qnV
+pHDtxK2rHKZSec3Kc97f+OlzDtU0s8/oypG0Yu+T+QE/noAaty8CgcBLiCGm3D4z
+eQvCyp2ifIx3aS0EPClKYME3x5TyZJbQ5EKYEsmWk5zpfNczwQCSjgnURs1X4Txv
+4vTShW6isvC4D1+nmK19jajlhk9humMshhLSkSsbWAMIJYtqwz/w6CN4b7QvXhcB
+x7d3BR8cL8/aLAJxBLx0hcenbEM6u8f3nAivllcrW0kMrJDErjT8unkQJdLWV3ct
+qvrSqBArpykBjayM52USIUuNZFUIvjmwN2XUlC46+388fWwIiPwnfM0=
 -----END RSA PRIVATE KEY-----
diff --git a/credentials/idp-signing.crt b/credentials/idp-signing.crt
index 034f9db..a7f2528 100644
--- a/credentials/idp-signing.crt
+++ b/credentials/idp-signing.crt
@@ -1,25 +1,25 @@
 -----BEGIN CERTIFICATE-----
-MIIEJzCCAo+gAwIBAgIUFmFRSFCknM+R2MDTUOUxy4Ly2a0wDQYJKoZIhvcNAQEL
-BQAwGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUub3JnMB4XDTIwMDIwNjE3MTk1NFoX
-DTQwMDIwNjE3MTk1NFowGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUub3JnMIIBojAN
-BgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEApypXQpLV3wqhAtxqO99neORxrWkM
-pmTF3w6/R8dvbxNIUAmO73l5lssAKcBUumzsxJiyuXNfBqpUColP94EByCUSNxmt
-iYiqv2t57dIX+0xVnQCp+IV6FjNG7IqZtODIicSeJ515uBKC2iVURtIUPG8Bx1h7
-IucPXgAfO5+fde+82nCH4/QTNTHED6JnsuATQMhLicTmQRCMTXLBirIC1iGDqc6h
-fqBPMKUKyVJ9cpB1z4DMZ3dK+E7OUeO2ewvA0y43s2Bd2OV6paJ6ZHLcLWMIEYue
-gpxfh2pGGDZeryxyfG72BNbJ2mf3sMz1EtBgXFsHjCnGiSJ/BRLRJ0bs+Fr2Wsd+
-DmhMkJ0QyfFsbuyfMhPXA3j95l25NHHH+OqZB5UUssvqfUZ8X0hs1Mt01en1Gfp+
-uS+FSnytcO+/7jIL4DRFhrHOEXZHqnGpcRgwti6WmBcQgW9nWFCAPhEaSSARUxxr
-tinfyg7zD8I9Jg9iwRZU6W/y7oMH5aifaZ+rAgMBAAGjZTBjMB0GA1UdDgQWBBQN
-5NoPrBmezuYsRGNOlMrQiVMNvTBCBgNVHREEOzA5gg9pZHAuZXhhbXBsZS5vcmeG
+MIIEJzCCAo+gAwIBAgIUZMvUeW53jFMs4M1rlNztvoKNXGowDQYJKoZIhvcNAQEL
+BQAwGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUub3JnMB4XDTIxMDMyNDE1NTQyMloX
+DTQxMDMyNDE1NTQyMlowGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUub3JnMIIBojAN
+BgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvtENeKgTFxJ3l8ZTeaFifLRLS4da
+xjnKy7JpTfrVOqZHGUQ3zAwY4xifs5rbiBkOAiLLBIqjJJalZQ6A+fSu34eVYdxp
+5VY5L2gAcF/6kf+wOMCU2zdEwiewM9CZMo6HN77Z/ZEC1737/OBaRHwCEtC8l1Bx
+U0V9TgEB/n31mtg5h7FWDPe6dgo1NSeCjsKVGHrdG4Ozo+JHvklqy6knbqnNvPqm
+cLv4nrp/wQnRalqv7/26dlzoecXmCICH4cToBVACILXs331bpWEdHEc+bxInja15
+BOwb4pWLbqD5Qaj9hnPFCAKFtA+Ivb9PKV+44eNN3n73dYEPmx21QeqXWVfn3Ukl
+4lIIhFC9XETbmSI+V8HLYl7e7n6GKN3hdVip0thN5vyPWYBt2DskW6+QFXry2F+E
+qMxNHUqJt0k3uu4pTZ9f/DsQaA+/e+H23DGBIOytNzBz1jbU0Do/35td39YvRGN4
+T5KOuwmGTjrB6cM0/WOxJhaKourpM6qiDs0bAgMBAAGjZTBjMB0GA1UdDgQWBBSA
+UDgNLBosYiGapWvY1CIRGm5f/jBCBgNVHREEOzA5gg9pZHAuZXhhbXBsZS5vcmeG
 Jmh0dHBzOi8vaWRwLmV4YW1wbGUub3JnL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3
-DQEBCwUAA4IBgQA9G+WW5ASr86DGtUZEwzp0ZQZ4EBj3/tAHG8VuORxbA8hMOFo0
-Iz/NfzFpurGJtd3S7o0DepEwQjMZoYja2bYSJkpHscm9sEcrIKyiu01kOsjCwncv
-xJ+cdILWS4JUZtk2vmnRjS/ufHLBPTcEYGrix0DoG3qPgqNXljRptrvrLfeDIvid
-AalmxNqWyKDNDgWua9iB9piEF3ZRe1Jc/Od5ByG1sjT8z+NbZuR7QHEwgziBl1ff
-4hpE84JvUhxDu8xhuwTJBkTh9Oh4+wKquRNwa95dhrQrYDF48oA90dboRaO4X4z8
-TxDy8v0QMbGFUIVqhDkVGPbzbir8Ni4vScjSRIzpkAX9FhfqoHaD8rl5f5DTpDPq
-dK6Kg9675akm5DKQ1SGq/3rl6ucDEtN1ma5UqBVZkXGKmo61PcnWMeTRioAprcnJ
-rYw6Kjf/0EqShDEbkSuiVR63dTr9bdFS9nt74uyuEpSBfT4ryRZxCOOlt/orIxUt
-Ae3vkDmc/eCooWg=
+DQEBCwUAA4IBgQBb9ncPd748rnxrJ7tat50vDGAj/wnFM/9qt6gfwSv7gCikj29V
+QYgZ0gB76xH7RdLw/iuR4g3stuoARt+CYrzkh/A/pG6/FAFI6HZvX/Lic7YLv/rp
+m0aRcBLDzu6gYZ66qm05iXLs1Kueq8Eh0txpbg35LUVZGtXxE6t4da8a/XfSfgDs
+KlUj7ANT1vkbDYXJiio60EqGWxMiyxTacEFOSUqRTlDL1wdvU8hrcyO4ZQSf20Mv
+uROvXwki8Zb1Hoakn51fgJIKvIM6ttLpNdwsXFWpopMw9s5obtrNAB4KbbuISXdn
+3AjJtynK9HuIOyBkphetJcOXj99bAn6VLyl3ieuPPLzXPQ9byNmLlwp0njJE2xtR
+HjztBijmO8wtif3di+nUSwHRG0DcuE7f06Z28+pSrpB0XHDmALSefbq5g51aIR64
+fgC3txaEwILjHFjdK7Iaf0DHqQDUyxqC00IWATB9Dr9dtMIeQVN46x4681AfKp8p
+oHdTCGNvbFo8vGI=
 -----END CERTIFICATE-----
diff --git a/credentials/idp-signing.key b/credentials/idp-signing.key
index 191cf78..cf8eb60 100644
--- a/credentials/idp-signing.key
+++ b/credentials/idp-signing.key
@@ -1,39 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIG4wIBAAKCAYEApypXQpLV3wqhAtxqO99neORxrWkMpmTF3w6/R8dvbxNIUAmO
-73l5lssAKcBUumzsxJiyuXNfBqpUColP94EByCUSNxmtiYiqv2t57dIX+0xVnQCp
-+IV6FjNG7IqZtODIicSeJ515uBKC2iVURtIUPG8Bx1h7IucPXgAfO5+fde+82nCH
-4/QTNTHED6JnsuATQMhLicTmQRCMTXLBirIC1iGDqc6hfqBPMKUKyVJ9cpB1z4DM
-Z3dK+E7OUeO2ewvA0y43s2Bd2OV6paJ6ZHLcLWMIEYuegpxfh2pGGDZeryxyfG72
-BNbJ2mf3sMz1EtBgXFsHjCnGiSJ/BRLRJ0bs+Fr2Wsd+DmhMkJ0QyfFsbuyfMhPX
-A3j95l25NHHH+OqZB5UUssvqfUZ8X0hs1Mt01en1Gfp+uS+FSnytcO+/7jIL4DRF
-hrHOEXZHqnGpcRgwti6WmBcQgW9nWFCAPhEaSSARUxxrtinfyg7zD8I9Jg9iwRZU
-6W/y7oMH5aifaZ+rAgMBAAECggGAIw0/ytfbPK+P33e0VuWbXsAYDhKO8n0C+Kiw
-9y4ccaALc6ztac2A71uVpyuLGKQqaXbTUwucC1u/z43HVNCaPQt47FDYEJS1qPmy
-UWnSWYFCGm+/NDtYxDrwTj0pycGwiyLNPuVIVo6bHX7iUw9N6vYj21b0SvdEQ6Om
-6OupliM06GDcPbI6LNdIkzaso9dUcisNm8/LsCz2Hm9Hoft9mMTiRMLtHg4jTMHu
-pxRC9bjQ2zfYpIFhGPv9SzKCWv61k1FC9VyYgV89xVtzdpxg9/h6hL8GGfzjgOSN
-inmxqmchFWgTlSJRJb18W146UXxLTFYPkGvoS4oj6dKHKcCbKIl1t0GmpGJiO8v6
-V4eeK1WM/M4L4ipX/4rBeyLtXfyIlJZpkVavyRAaObCglrpXgH5zqoe2i20Uy+bS
-YRjNkSuFBLmM3NZTM8+qfSMgQjYKpJBrmbyh0NmYNITDyfeXzpGPPc5PsfwB3DZL
-BE01YSHCQaCfpONV0uc0BG8HoF+xAoHBAM9VvjKStNnbaPGTs3HV5lUe1ubf/b25
-Cx7Mo9ZPkf5zifM8AxmZs7bQqhqyCKo02+esKd/+hGPYK+M3KCilWK0G9XNakmw7
-nxNJ0VI0mycTghoSFj1/m97epDD8HsKofQWWL1xG0JnlreE6Vv15+BCJ8tCnXElk
-QBDMkm8CrWfIznEViMKvnh18bH0XIVkZJCCXOAZno3RUBp7k5enyps4hvxcMQqTX
-FBEBADyByp/gjEUNQZtCUNPUpN7D0ZAERwKBwQDOZugvZyDkqlT679/75LCc4ym6
-wXuRFLTDE8VfYw1xZ/TIqkSabYRF0cJWTvqSb9YdGfKHLnyKELJdUEv0wxg0JGIP
-RB/xcMYdHvjpALUO/18lSei1wz5zMgNuAo+/aC0zO3l7By9tkgAfvTFjBMTP/pN/
-/m1N2+IjTY2AxIXzcfRw5doeJp/8RLO0uCKT8rzz3yAVnJTtTLAU8fyjkIoX0wfq
-qaK1rJcvWI2yIAnvOrwK8N8KnHZu8JPEZ+n9r30CgcBlqc5sL+F73YkUw26+x7p8
-THXlmTlrOPvJ61/+qt+UXATtfqSqfeJQJvrxwhBbnTWi4Jlb2woBhzLl49rOK11S
-4lGicWvQpF947r4zx9W4EGm/7NR47UR5wMPTvRw8KK+8+IpafeK1Q5jCEoArJA5N
-1cZ5J0cqOXzsf9Lhmfd7J0yKyJtZkxE9tg/gOmJAtQIw9NUk1tagKL9iVCykTTYb
-ZxKy83EOMOQG/m2mPaIkSM+e4EQmJBtL8z2weWYdbusCgcAhyjUOtZpr9PqujiCk
-Ez9an9HQEibRjIs/OHhickvcGgG37DAI/A7gg0OGb62T1Z0+7GWI/fJDhBI/NosI
-yfunZaFsEGIOW8EDOXPUaVo611HTP/NJ9mm94B0xoFe6JSrpLT5pBrcb///nMkjo
-hfpWdr3dAWERkwLFdsfIoeOwBCLZbLe1oeslGHY3CsIWaHHIlumgwB6dbqWQ+EC8
-4kfJOLIeF6FcjqG9jYi89YPK11m7jM1m5lB5Pwdh6wUik90CgcEAmhPeuvRrwg8L
-WWGG5d89i+tlqJ6ooeUJ8Dn8jFUe8i0XfLFys4min4KsDb6urDs25ZcJqpaQ/TXa
-j0zYdaog+fPY5hmO18PoDq6jcv6XczJnq/XkgPzYR1i5PAe6gjXdMPWua9VMgqCm
-aVqJxSCTdmd/RKhw8lUSqchT7p57B/5d22FHoky4fpJH7ihh53EVDHRYG/MSEqBl
-SV0LK7SZSqZA80+tFnDf7r4TLDWVpmkLl9fn32xIE7EKjyeXUcuk
+MIIG4gIBAAKCAYEAvtENeKgTFxJ3l8ZTeaFifLRLS4daxjnKy7JpTfrVOqZHGUQ3
+zAwY4xifs5rbiBkOAiLLBIqjJJalZQ6A+fSu34eVYdxp5VY5L2gAcF/6kf+wOMCU
+2zdEwiewM9CZMo6HN77Z/ZEC1737/OBaRHwCEtC8l1BxU0V9TgEB/n31mtg5h7FW
+DPe6dgo1NSeCjsKVGHrdG4Ozo+JHvklqy6knbqnNvPqmcLv4nrp/wQnRalqv7/26
+dlzoecXmCICH4cToBVACILXs331bpWEdHEc+bxInja15BOwb4pWLbqD5Qaj9hnPF
+CAKFtA+Ivb9PKV+44eNN3n73dYEPmx21QeqXWVfn3Ukl4lIIhFC9XETbmSI+V8HL
+Yl7e7n6GKN3hdVip0thN5vyPWYBt2DskW6+QFXry2F+EqMxNHUqJt0k3uu4pTZ9f
+/DsQaA+/e+H23DGBIOytNzBz1jbU0Do/35td39YvRGN4T5KOuwmGTjrB6cM0/WOx
+JhaKourpM6qiDs0bAgMBAAECggGAXXk7CCgNcffx7b+RlLuh60TGvbEInqIg3bgA
+Ldr6KUja+12Xl7U1W8nsMadic0ESw6kXmpnvYTUKwH5iYA+kuotIei/nEBk02iww
+Stw5etuuD58HTHu+iv22Kyu8YC/BvWUYlEY9BkJi9nVQwsucmGr4d4dIfGpF/7gu
+qeQ6NChHxljwtlmEVd6aQfeg1R4su1k0hw31Kgrm6ig80JeEYYl8515BumfaWqcx
+ffa5R0g1d3LrrJ/GoiB3lyKfbdFuns5Nw6Cd4gBwTFoFwZrRPGXQGnBNLhaicSFQ
+vchLZQDe+SCdfOcdCmYI7pm9i8jbI+deTzDCT1am3gqvoil0Y+TW9EDk20a4vVnH
+unSsz+kIpVw1O8Hkc7U4yPXxLbS8qTMJUmp0GwLV9egGy8iVVjPXp8VbyjiEDNIJ
+Sp8y9wvjvDPDPxPg7H9Jkgk41muBVuo4KfpaojXSRomlqSD8NfzL6TIMSCPFq2vO
+brp3Gblf14jwj1gPaHiQ7Kr1cH/BAoHBAOLoUvcS1kbxp0NDDBiEgCLPXpoG8MMc
+Y3iSAZ9dtDXyqaUiFEyrpOCtJdIo/YW+on7J86t/+2t5hhJ1VQq7jUpHvoCnIOEj
+SuMAv806owV7XueoFBpaKBEMp28gWFAygeKhGI9g75hjq23f55XT43jPB4NOmYmW
+/Qle2ZS3G/lWKfMbNPbk4MAvvCULVWjaXgzOKnU3L4LybXYq1KzW0xxI7bAEj5ft
+38SyzCJn0pIhpvDgQe0TpkBGajDeHEQiNQKBwQDXSCJbWC8B8dF/kjdTPeeDo/gX
+sK2nBRxQuNJ6BwpAHaPcOA6G3Xcb9LNDFuRReh5jFDs1G86N4ZhL2dVthsQJHt/9
+1pNrn7/UlOjrgRKVZDR8gFZxvuxn/TifuR3xv6+kTgaqknMepA5SpD4VB55VBeJP
+B5OJtSrHxHh4fty+OMvvmpBNC+505yxY69nIRxAtOaFH6xFyM/klp7jgKsJV4lco
+Un1WO0BqflPkLXlbMx4FjcSjikUnkhzbJxdnHA8CgcARfOxgBIClSRymD3XQMe4a
+QLc+0cgekYKNGVusp7Eq8z/l7UF5Q0Va151xnB0mALJPaUsxbZS4DM6rf4WFZT0X
+e34QNlFPaMPtyPH/ZESKOJ7w5cBe45Hw9nO1Gd4UmD/wcpANBOCScyQUPMyBfKos
+dnBSy20D8LIh1cCZOJ+cUOq8xN0JJky4IzWx+TSk9yeGfyFAlXdA9WRAVj6773an
+2GsRRNi4UeoMI+edwzi0cImISRBrsDcA/yxSBdxR1/0CgcAry0zR8Dp/1sWbgg8n
+K+yw5uZNS2/IDk4YTcDjehMnv9/ZqL2rydm1Ii5lc3625HTSCweQYju+uSnWJFY6
+lbPDdzhx1vjeZ/0KLdDEN9mj8mKLAUCUmxZUgTrHo0zoJOqCLi1E/c3VaeJQBYFr
+ncUj3rKPCSeGWAh/4wPu3z/gooU6FONOCSNVPMHUxQXkrDAqQxMAIl3GMbR5aIk/
+cPNfrU+1sDI3HI6aG2DNhkKtvtRYpOJfsn0m855TJryoCRkCgcAHnLZQEkXP624q
+Pq5i5OaKUUeVfIlxHW4S9ucTDw/+G3iHdV9Gxeq3bmMh5B8c8VL9YIHHTKn1xs+h
+iOolSuroDbzzjn+7wF6g2+6wxGg5G0JAiU2WNR4Lv1yJ57tkL42wmEhbzEdqtg47
+RPHPnKhBTxQ4dRMQ9/wCxFsgM1CuD4Fpog4VK06HGt9fXB2iDNQrZmgHbKuGmCL/
+p/9Ftzzg5fo/D3Vd28r2rVo1r4M/LmPuQ5ODWffn4leVNkkV3Gg=
 -----END RSA PRIVATE KEY-----
diff --git a/credentials/sealer.jks b/credentials/sealer.jks
index 0274ab6..f10f00a 100644
Binary files a/credentials/sealer.jks and b/credentials/sealer.jks differ
diff --git a/credentials/sealer.kver b/credentials/sealer.kver
index 81a9ede..aa1fae9 100644
--- a/credentials/sealer.kver
+++ b/credentials/sealer.kver
@@ -1,2 +1,2 @@
-#Thu Feb 06 17:19:55 UTC 2020
+#Wed Mar 24 15:54:24 UTC 2021
 CurrentVersion=1
diff --git a/credentials/secrets.properties b/credentials/secrets.properties
index afd43f4..26d4af7 100644
--- a/credentials/secrets.properties
+++ b/credentials/secrets.properties
@@ -1,5 +1,5 @@
 # This is a reserved spot for most properties containing passwords or other secrets.
-# Created by install at 2020-02-06T17:19:55.442Z
+# Created by install at 2021-03-24T15:54:24.596740Z
 
 # Access to internal AES encryption key
 idp.sealer.storePassword = changeit
diff --git a/views/admin/hello.vm b/views/admin/hello.vm
new file mode 100644
index 0000000..33a0528
--- /dev/null
+++ b/views/admin/hello.vm
@@ -0,0 +1,73 @@
+##
+## Velocity Template for Hello World page.
+##
+## Velocity context will contain the following properties
+## flowRequestContext - the Spring Web Flow RequestContext
+## encoder - HTMLEncoder class
+## request - HttpServletRequest
+## response - HttpServletResponse
+## profileRequestContext - root of context tree
+## subjectContext - ProfileRequestContext -> SubjectContext
+## attributeContext - ProfileRequestContext -> AttributeContext
+## environment - Spring Environment object for property resolution
+## custom - arbitrary object injected by deployer
+##
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1.0">
+    <title>#springMessageText("idp.title", "Web Login Service") - #springMessageText("hello-world.title", "Hello World")</title>
+    <link rel="stylesheet" type="text/css" href="$request.getContextPath()/css/main.css">
+  </head>
+  
+  <body>
+    <div class="wrapper">
+      <div class="container" style="width: 100%">
+        <header>
+          <img src="$request.getContextPath()#springMessage("idp.logo")" alt="#springMessageText("idp.logo.alt-text", "logo")">
+          <h3>#springMessageText("idp.title", "Web Login Service")</h3>
+        </header>
+                
+        <div class="content">
+          <h4>#springMessageText("hello-world.greeting", "Greetings"), <em>$encoder.encodeForHTML($subjectContext.getPrincipalName())</em></h4>
+          <br/>
+          <h4>Authenticated By</h4>
+          #foreach ($result in $subjectContext.getAuthenticationResults().entrySet())
+            <blockquote>$encoder.encodeForHTML($result.getKey())</blockquote>
+          #end
+          <br/>
+          <h4>Java Principals in Subjects</h4>
+          #foreach ($s in $subjectContext.getSubjects())
+            #foreach ($p in $s.getPrincipals())
+              <blockquote>$encoder.encodeForHTML($p)<blockquote>
+            #end
+          #end
+          #if ($attributeContext && !$attributeContext.getUnfilteredIdPAttributes().isEmpty())
+            <br/>
+            <h4>Attributes:</h4>
+            #foreach ($a in $attributeContext.getUnfilteredIdPAttributes())
+              #if (!$a.getValues().isEmpty())
+                <br/>
+                <h5>$encoder.encodeForHTML($a.getId())</h5>
+                  #foreach ($v in $a.getValues())
+                    <blockquote>$encoder.encodeForHTML($v.getDisplayValue())</blockquote>
+                  #end
+              #end
+            #end
+          #end
+        </div>
+
+        <header>
+          <h3><a href="$request.getContextPath()/profile/admin/hello">#springMessageText("hello-world.reload", "Reload the Page")</a></h3>
+        </header>
+      </div>
+
+      <footer>
+        <div class="container container-footer">
+          <p class="footer-text">#springMessageText("idp.footer", "Insert your footer text here.")</p>
+        </div>
+      </footer>
+    </div>
+  </body>
+</html>
diff --git a/views/admin/unlock-keys.vm b/views/admin/unlock-keys.vm
deleted file mode 100644
index a8228ae..0000000
--- a/views/admin/unlock-keys.vm
+++ /dev/null
@@ -1,97 +0,0 @@
-##
-## Velocity Template for Attended Startup Unlock Utility
-##
-## Velocity context will contain the following properties:
-## flowRequestContext - the Spring Web Flow RequestContext
-## request - HttpServletRequest
-## response - HttpServletResponse
-## profileRequestContext
-## environment - Spring Environment object for property resolution
-## custom - arbitrary object injected by deployer
-##
-#set ($title = $springMacroRequestContext.getMessage("idp.title", "Web Login Service"))
-#set ($titleSuffix = $springMacroRequestContext.getMessage("idp.unlock-keys.title", "Attended Restart Key Unlock"))
-#set ($eventId = $profileRequestContext.getSubcontext("org.opensaml.profile.context.EventContext").getEvent())
-#set ($state = $flowRequestContext.getCurrentState().getId())
-<!DOCTYPE html>
-<html>
-    <head>
-        <meta charset="utf-8">
-        <meta name="viewport" content="width=device-width,initial-scale=1.0">
-        <title>$title - $titleSuffix</title>
-        <link rel="stylesheet" type="text/css" href="$request.getContextPath()/css/main.css">
-    </head>
-    
-    <body>
-    <div class="wrapper">
-        <div class="container">
-            <header>
-                <img src="$request.getContextPath()#springMessage("idp.logo")" alt="#springMessageText("idp.logo.alt-text", "logo")">
-                <h3>$title - $titleSuffix</h3>
-            </header>
-        
-            <div class="content">
-            #if ($state == "end")
-                <strong>#springMessageText("idp.unlock-keys.complete", "The system is unlocked and ready for use.")</strong>
-                <p><a href="$request.getContextPath()/profile/SAML2/Unsolicited/SSO?providerId=https://sp.example.org/shibboleth">Validation Link</a></p>
-            #else
-                #if ($eventId == "InvalidMessage")
-                    <p class="form-element form-error">
-                    #springMessageText("idp.unlock-keys.error", "Unlock failed; check log for specific message.")
-                    </p>
-                    <br/><br/>
-                #end
-            
-                <form action="$flowExecutionUrl" method="post">
-                  #parse("csrf/csrf.vm")
-                  
-                  <!--
-                  If you have multiple key strategies defined, you'll need multiple pairs of form fields for
-                  the passwords, labeled in the order they're fed into the shibboleth.unlock-keys.KeyStrategies
-                  bean. If you have none, remove the fields.
-                  -->
-
-                  <div class="form-element-wrapper">
-                    <label for="password">#springMessageText("idp.unlock-keys.keystorePassword", "DataSealer Keystore Password")</label>
-                    <input class="form-element form-field" id="password" name="keystorePassword" type="password" />
-                  </div>
-
-                  <div class="form-element-wrapper">
-                    <label for="password">#springMessageText("idp.unlock-keys.keyPassword", "DataSealer Key Password")</label>
-                    <input class="form-element form-field" id="password" name="keyPassword" type="password" />
-                  </div>
-
-                  <!--
-                  If you have multiple private keys defined, you'll need a form field for each passwords, labeled in the order
-                  they're fed into the shibboleth.unlock-keys.Credentials/PrivateKeys beans. If you have none, remove the fields.
-                  -->
-
-                  <div class="form-element-wrapper">
-                    <label for="password">#springMessageText("idp.unlock-keys.privateKeyPassword", "Private Key Password")</label>
-                    <input class="form-element form-field" id="password" name="privateKeyPassword" type="password" />
-                  </div>
-                  
-                  <div class="form-element-wrapper">
-                    <button class="form-element form-button" type="submit" name="_eventId_proceed"
-                        >#springMessageText("idp.unlock-keys.unlock", "Unlock")</button>
-                  </div>
-
-                  <div class="form-element-wrapper">
-                    <button class="form-element form-button" type="submit" name="_eventId_cancel"
-                        >#springMessageText("idp.unlock-keys.cancel", "Cancel")</button>
-                  </div>
-                  
-                </form>
-            #end
-            </div>
-        </div>
-
-        <footer>
-            <div class="container container-footer">
-                <p class="footer-text">#springMessageText("idp.footer", "Insert your footer text here.")</p>
-            </div>
-        </footer>
-        
-    </div>
-    </body>
-</html>
\ No newline at end of file
diff --git a/views/duo.vm b/views/duo.vm
deleted file mode 100644
index d212df7..0000000
--- a/views/duo.vm
+++ /dev/null
@@ -1,83 +0,0 @@
-##
-## Velocity Template for Duo login view-state
-##
-## Velocity context will contain the following properties
-## flowExecutionUrl - the form action location
-## flowRequestContext - the Spring Web Flow RequestContext
-## flowExecutionKey - the SWF execution key (this is built into the flowExecutionUrl)
-## profileRequestContext - root of context tree
-## authenticationContext - context with authentication request information
-## rpUIContext - the context with SP UI information from the metadata
-## canonicalUsername - name of user passed to Duo
-## duoHost - API hostname for Duo frame
-## duoRequest - signed Duo request message
-## duoScriptPath - path to Duo JavaScript source
-## encoder - HTMLEncoder class
-## request - HttpServletRequest
-## response - HttpServletResponse
-## environment - Spring Environment object for property resolution
-## custom - arbitrary object injected by deployer
-##
-<!DOCTYPE html>
-<html>
-<head>
-    <meta http-equiv="X-UA-Compatible" content="IE=edge">
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>#springMessageText("idp.title", "Web Login Service")</title>
-    <link rel="stylesheet" type="text/css" href="$request.getContextPath()/css/main.css">
-    <style>
-      #duo_iframe {
-        width: 100%;
-        min-width: 304px;
-        max-width: 620px;
-        height: 330px;
-      }
-    </style>
-</head>
-<body>
-    <div class="wrapper">
-      <div class="container">
-        <header>
-          <img src="$request.getContextPath()#springMessage("idp.logo")" alt="#springMessageText("idp.logo.alt-text", "logo")">
-        </header>
-
-        <div class="content">
-          <div class="column one">
-          
-            <h3>#springMessageText("idp.login.duoRequired", "Authentication with Duo is required for the requested service.")</h3>
-
-            <noscript>#springMessageText("idp.login.duoNoScript", "The Duo service requires JavaScript.")</noscript>          
-            <script src="$request.getContextPath()$duoScriptPath"></script>
-            <iframe id="duo_iframe"
-                data-host="$duoHost"
-                data-sig-request="$duoRequest"
-                data-post-action="$flowExecutionUrl"
-                frameborder="0"
-            >
-            </iframe>
-            <form id="duo_form" method="post">
-                #parse("csrf/csrf.vm")
-                <input type="hidden" name="_eventId" value="proceed" />
-            </form>
-            
-            <h3 style="text-align: center">
-                <a href="$flowExecutionUrl&_eventId=cancel">#springMessageText("idp.login.duoCancel", "Cancel this Request")</a>
-            </h3>
-          </div>
-          <div class="column two">
-            <ul class="list list-help">
-              <li class="list-help-item"><a href="#springMessageText("idp.url.helpdesk", '#')"><span class="item-marker">&rsaquo;</span> #springMessageText("idp.login.needHelp", "Need Help?")</a></li>
-            </ul>
-          </div>
-        </div>
-      </div>
-
-      <footer>
-        <div class="container container-footer">
-          <p class="footer-text">#springMessageText("idp.footer", "Insert your footer text here.")</p>
-        </div>
-      </footer>
-    </div>
-</body>
-</html>
diff --git a/views/error.vm b/views/error.vm
index dcb8e2b..a44bd6f 100644
--- a/views/error.vm
+++ b/views/error.vm
@@ -34,10 +34,12 @@
     #set ($eventKey = $springMacroRequestContext.getMessage("$eventId", "error"))
     #set ($titleSuffix = $springMacroRequestContext.getMessage("${eventKey}.title", "$defaultTitleSuffix"))
     #set ($message = $springMacroRequestContext.getMessage("${eventKey}.message", "$defaultTitleSuffix: $eventId"))
+    $response.setStatus(500)
 #else
 	## This is a catch-all that theoretically shouldn't happen?
     #set ($titleSuffix = $defaultTitleSuffix)
     #set ($message = $springMacroRequestContext.getMessage("idp.message", "An unidentified error occurred."))
+    $response.setStatus(500)
 #end
 ##
 <!DOCTYPE html>
diff --git a/views/intercept/attribute-release.vm b/views/intercept/attribute-release.vm
deleted file mode 100644
index c170b69..0000000
--- a/views/intercept/attribute-release.vm
+++ /dev/null
@@ -1,160 +0,0 @@
-##
-## Velocity Template for DisplayAttributeReleasePage view-state
-##
-## Velocity context will contain the following properties :
-##
-## attributeReleaseContext - context holding consentable attributes
-## attributeReleaseFlowDescriptor - attribute consent flow descriptor
-## attributeDisplayNameFunction - function to display attribute name
-## attributeDisplayDescriptionFunction - function to display attribute description
-## consentContext - context representing the state of a consent flow
-## encoder - HTMLEncoder class
-## flowExecutionKey - SWF execution key (this is built into the flowExecutionUrl)
-## flowExecutionUrl - form action location
-## flowRequestContext - Spring Web Flow RequestContext
-## profileRequestContext - OpenSAML profile request context
-## request - HttpServletRequest
-## response - HttpServletResponse
-## rpUIContext - context with SP UI information from the metadata
-## environment - Spring Environment object for property resolution
-#set ($serviceName = $rpUIContext.serviceName)
-#set ($serviceDescription = $rpUIContext.serviceDescription)
-#set ($informationURL = $rpUIContext.informationURL)
-#set ($privacyStatementURL = $rpUIContext.privacyStatementURL)
-#set ($rpOrganizationLogo = $rpUIContext.getLogo())
-#set ($rpOrganizationName = $rpUIContext.organizationDisplayName)
-#set ($replaceDollarWithNewline = true)
-##
-<!DOCTYPE html>
-<html>
-    <head>
-        <meta charset="UTF-8">
-        <meta name="viewport" content="width=device-width,initial-scale=1.0">
-        <link rel="stylesheet" type="text/css" href="$request.getContextPath()/css/consent.css">
-        <title>#springMessageText("idp.attribute-release.title", "Information Release")</title>
-    </head>
-    <body>
-        <form action="$flowExecutionUrl" method="post" style="padding:10px" >
-            #parse("csrf/csrf.vm")
-            <div class="box">
-                <header>
-                    <img src="$request.getContextPath()#springMessage("idp.logo")" alt="#springMessageText("idp.logo.alt-text", "logo")" class="federation_logo">
-                    #if ($rpOrganizationLogo)
-                        <img src="$encoder.encodeForHTMLAttribute($rpOrganizationLogo)" alt="logo for $encoder.encodeForHTMLAttribute($serviceName)" class="organization_logo">
-                    #end
-                </header>
-                #if ($serviceName)
-                    <p style="margin-top: 70px;">
-                        #springMessageText("idp.attribute-release.serviceNameLabel", "You are about to access the service:")<br>
-                        <span class="service_name">$serviceName</span>
-                        #if ($rpOrganizationName)
-                            #springMessageText("idp.attribute-release.of", "of") <span class="organization_name">$encoder.encodeForHTML($rpOrganizationName)</span>
-                        #end
-                    </p>
-                #end
-                #if ($serviceDescription)
-                    <p style="margin-top: 10px;">
-                        #springMessageText("idp.attribute-release.serviceDescriptionLabel", "Description as provided by this service:")<br>
-                        <span class="service_description">$encoder.encodeForHTML($serviceDescription)</span>
-                        <br>
-                    </p>
-                #end
-                #if ($informationURL)
-                    <p style="margin-top: 10px;">
-                        <a href="$informationURL">#springMessageText("idp.attribute-release.informationURLLabel", "Additional information about the service")</a>
-                    </p>
-                #end
-                <div id="attributeRelease">
-                    <table>
-                        <thead>
-                            <tr>
-                                <th colspan="3">
-                                    #springMessageText("idp.attribute-release.attributesHeader", "Information to be Provided to Service")
-                                </th>
-                            </tr>
-                        </thead>
-                        <tbody>
-                            #foreach ($attribute in $attributeReleaseContext.getConsentableAttributes().values())
-                                <tr>
-                                    <td>$encoder.encodeForHTML($attributeDisplayNameFunction.apply($attribute))</td>
-                                    <td>
-                                        #foreach ($value in $attribute.values)
-                                            #if ($replaceDollarWithNewline)
-                                                #set ($encodedValue = $encoder.encodeForHTML($value.getDisplayValue()).replaceAll($encoder.encodeForHTML('$'),"<br>"))
-                                            #else
-                                                #set ($encodedValue = $encoder.encodeForHTML($value.getDisplayValue()))
-                                            #end
-                                            #if ($attributeReleaseFlowDescriptor.perAttributeConsentEnabled)
-                                                <label for="$attribute.id"><strong>$encodedValue</strong></label>
-                                            #else
-                                                <strong>$encodedValue</strong>
-                                            #end
-                                            <br>
-                                        #end
-                                    </td>
-                                    <td style="vertical-align: top">
-                                        #if ($attributeReleaseFlowDescriptor.perAttributeConsentEnabled)
-                                            #set ($inputType = "checkbox")
-                                        #else
-                                            #set ($inputType = "hidden")
-                                        #end
-                                        <input id="$attribute.id" type="$inputType" name="_shib_idp_consentIds" value="$encoder.encodeForHTML($attribute.id)" checked>
-                                    </td>
-                                </tr>
-                            #end
-                        </tbody>
-                    </table>
-                </div>
-                #if ($privacyStatementURL)
-                    <p style="margin-top: 10px;">
-                        <a href="$privacyStatementURL">#springMessageText("idp.attribute-release.privacyStatementURLLabel", "Data privacy information of the service")</a>
-                    </p>
-                #end
-                <div style="float:left;">
-                    <p>
-                        #springMessageText("idp.attribute-release.confirmationQuestion", "The information above would be shared with the service if you proceed. Do you agree to release this information to the service every time you access it?")
-                    </p>
-                    #if ($attributeReleaseFlowDescriptor.doNotRememberConsentAllowed || $attributeReleaseFlowDescriptor.globalConsentAllowed)
-                        <div id="generalConsentDiv" style="display: block; background-color: #F6F6F6;border: 1px gray solid; padding: 10px; width: 92%;">
-                        #springMessageText("idp.attribute-release.consentMethod", "Select an information release consent duration:")
-                    #end
-                    #if ($attributeReleaseFlowDescriptor.doNotRememberConsentAllowed)
-                        <p>
-                            <input id="_shib_idp_doNotRememberConsent" type="radio" name="_shib_idp_consentOptions" value="_shib_idp_doNotRememberConsent">
-                            <label for="_shib_idp_doNotRememberConsent">#springMessageText("idp.attribute-release.doNotRememberConsent", "Ask me again at next login")</label>
-                            <ul>
-                                <li>#springMessageText("idp.attribute-release.doNotRememberConsentItem", "I agree to send my information this time.")</li>
-                            </ul>
-                        </p>
-                    #end
-                    #if ($attributeReleaseFlowDescriptor.doNotRememberConsentAllowed || $attributeReleaseFlowDescriptor.globalConsentAllowed)
-                        <p>
-                            <input id="_shib_idp_rememberConsent" type="radio" name="_shib_idp_consentOptions" value="_shib_idp_rememberConsent" checked>
-                            <label for="_shib_idp_rememberConsent">#springMessageText("idp.attribute-release.rememberConsent", "Ask me again if information changes")</label>
-                            <ul>
-                                <li>#springMessageText("idp.attribute-release.rememberConsentItem", "I agree that the same information will be sent automatically to this service in the future.")</li>
-                            </ul>
-                        </p>
-                    #end
-                    #if ($attributeReleaseFlowDescriptor.globalConsentAllowed)
-                        <p>
-                            <input id="_shib_idp_globalConsent" type="radio" name="_shib_idp_consentOptions" value="_shib_idp_globalConsent">
-                            <label for="_shib_idp_globalConsent">#springMessageText("idp.attribute-release.globalConsent", "Do not ask me again")</label>
-                            <ul>
-                                <li>#springMessageText("idp.attribute-release.globalConsentItem", "I agree that <strong>all</strong> of my information will be released to <strong>any</strong> service.")</li>
-                            </ul>
-                        </p>
-                    #end
-                    #if ($attributeReleaseFlowDescriptor.doNotRememberConsentAllowed || $attributeReleaseFlowDescriptor.globalConsentAllowed)
-                        #springMessageText("idp.attribute-release.consentMethodRevoke", "This setting can be revoked at any time with the checkbox on the login page.")
-                        </div>
-                    #end
-                    <p style="text-align: center;">
-                        <input type="submit" name="_eventId_AttributeReleaseRejected" value="#springMessageText("idp.attribute-release.reject", "Reject")" style="margin-right: 30px;">
-                        <input type="submit" name="_eventId_proceed" value="#springMessageText("idp.attribute-release.accept", "Accept")">
-                    </p>
-                </div>
-            </div>
-        </form>
-    </body>
-</html>
diff --git a/views/intercept/expiring-password.vm b/views/intercept/expiring-password.vm
deleted file mode 100644
index 4395844..0000000
--- a/views/intercept/expiring-password.vm
+++ /dev/null
@@ -1,54 +0,0 @@
-##
-## Velocity Template for expiring password view
-##
-## Velocity context will contain the following properties
-## flowExecutionUrl - the form action location
-## flowRequestContext - the Spring Web Flow RequestContext
-## flowExecutionKey - the SWF execution key (this is built into the flowExecutionUrl)
-## profileRequestContext - root of context tree
-## authenticationContext - context with authentication request information
-## authenticationErrorContext - context with login error state
-## authenticationWarningContext - context with login warning state
-## ldapResponseContext - context with LDAP state (if using native LDAP)
-## encoder - HTMLEncoder class
-## request - HttpServletRequest
-## response - HttpServletResponse
-## environment - Spring Environment object for property resolution
-## custom - arbitrary object injected by deployer
-##
-<!DOCTYPE html>
-<html>
-    <head>
-        <meta charset="utf-8">
-        <meta name="viewport" content="width=device-width,initial-scale=1.0">
-        <title>#springMessageText("idp.title", "Web Login Service")</title>
-        <link rel="stylesheet" type="text/css" href="$request.getContextPath()/css/main.css">
-        <meta http-equiv="refresh" content="20;url=$flowExecutionUrl&_eventId_proceed=1">
-    </head>
-      
-    <body>
-      <div class="wrapper">
-        <div class="container">
-            <header>
-                <img src="$request.getContextPath()#springMessage("idp.logo")" alt="#springMessageText("idp.logo.alt-text", "logo")">
-                <h3>#springMessageText("idp.login.expiringSoon", "Your password will be expiring soon!")</h3>
-            </header>
-        
-            <div class="content">
-                <p>#springMessageText("idp.login.changePassword", "To create a new password now, go to")
-                <strong><a href="#" target="_blank">#</a></strong>.</p>
-                <p>#springMessageText("idp.login.proceedBegin", "Your login will proceed in 20 seconds or you may click")
-                <strong><a href="$flowExecutionUrl&_eventId_proceed=1">#springMessageText("idp.login.proceedHere", "here")</a></strong>
-                #springMessageText("idp.login.proceedEnd", "to continue").</p>
-            </div>
-        </div>
-
-        <footer>
-          <div class="container container-footer">
-            <p class="footer-text">#springMessageText("idp.footer", "Insert your footer text here.")</p>
-          </div>
-        </footer>
-          
-      </div>
-    </body>
-</html>
\ No newline at end of file
diff --git a/views/intercept/impersonate.vm b/views/intercept/impersonate.vm
deleted file mode 100644
index 37c486c..0000000
--- a/views/intercept/impersonate.vm
+++ /dev/null
@@ -1,90 +0,0 @@
-##
-## Velocity Template for expiring password view
-##
-## Velocity context will contain the following properties
-## flowExecutionUrl - the form action location
-## flowRequestContext - the Spring Web Flow RequestContext
-## flowExecutionKey - the SWF execution key (this is built into the flowExecutionUrl)
-## profileRequestContext - root of context tree
-## rpUIContext - the context with SP UI information from the metadata
-## encoder - HTMLEncoder class
-## request - HttpServletRequest
-## response - HttpServletResponse
-## environment - Spring Environment object for property resolution
-## custom - arbitrary object injected by deployer
-##
-#set ($rpContext = $profileRequestContext.getSubcontext('net.shibboleth.idp.profile.context.RelyingPartyContext'))
-<!DOCTYPE html>
-<html>
-    <head>
-        <meta charset="utf-8">
-        <meta name="viewport" content="width=device-width,initial-scale=1.0">
-        <title>#springMessageText("idp.title", "Web Login Service")</title>
-        <link rel="stylesheet" type="text/css" href="$request.getContextPath()/css/main.css">
-    </head>
-      
-    <body>
-      <div class="wrapper">
-        <div class="container">
-          <header>
-            <img src="$request.getContextPath()#springMessage("idp.logo")" alt="#springMessageText("idp.logo.alt-text", "logo")">
-              <h3>#springMessageText("idp.impersonate.header", "Account Impersonation")</h3>
-          </header>
-        
-          <div class="content">
-
-            <form action="$flowExecutionUrl" method="post">
-            #parse("csrf/csrf.vm")
-            #set ($serviceName = $rpUIContext.serviceName)
-            #if ($serviceName && !$rpContext.getRelyingPartyId().contains($serviceName))
-              <legend>
-                $encoder.encodeForHTML($serviceName)
-              </legend>
-            #end
-
-              <legend>
-                #springMessageText("idp.impersonate.text", "Enter an account name to impersonate to this service or continue normally.")
-              </legend>
-
-              <div class="form-element-wrapper">
-                <label for="impersonation">#springMessageText("idp.impersonate.login-as", "Login as")</label>
-                <input class="form-element form-field" id="impersonation" name="principal" type="text" />
-                
-                <!-- Defaults to input box above, example below populates a select list from an IdPAttribute. -->
-                <!--
-                #set ($attributeContext = $rpContext.getSubcontext('net.shibboleth.idp.attribute.context.AttributeContext'))
-                #set ($usernamesAttribute = $attributeContext.getUnfilteredIdPAttributes().get("impersonatableUsernames"))
-                <select class="form-element form-field" id="impersonation" name="principal">
-                #if ($usernamesAttribute)
-                  #foreach ($username in $usernamesAttribute.getValues())
-                    <option value="$encoder.encodeForHTML($username.getValue())">$encoder.encodeForHTML($username.getValue())</option>
-                  #end
-                #end
-                </select>
-                -->
-              </div>
-
-              <div class="form-element-wrapper">
-                <button class="form-element form-button" type="submit" name="_eventId_impersonate"
-                    >#springMessageText("idp.impersonate.impersonate", "Impersonate")</button>
-              </div>
-
-              <div class="form-element-wrapper">
-                <button class="form-element form-button" type="submit" name="_eventId_proceed"
-                    >#springMessageText("idp.impersonate.continue", "Continue Normally")</button>
-              </div>
-                
-            </form>
-
-          </div>
-        </div>
-
-        <footer>
-          <div class="container container-footer">
-            <p class="footer-text">#springMessageText("idp.footer", "Insert your footer text here.")</p>
-          </div>
-        </footer>
-          
-      </div>
-    </body>
-</html>
\ No newline at end of file
diff --git a/views/intercept/terms-of-use.vm b/views/intercept/terms-of-use.vm
deleted file mode 100644
index 67b2c15..0000000
--- a/views/intercept/terms-of-use.vm
+++ /dev/null
@@ -1,69 +0,0 @@
-##
-## Velocity Template for DisplayTermsOfUsePage view-state
-##
-## Velocity context will contain the following properties :
-##
-## encoder - HTMLEncoder class
-## flowExecutionKey - SWF execution key (this is built into the flowExecutionUrl)
-## flowExecutionUrl - form action location
-## flowRequestContext - Spring Web Flow RequestContext
-## request - HttpServletRequest
-## response - HttpServletResponse
-## rpUIContext - context with SP UI information from the metadata
-## termsOfUseId - terms of use ID to lookup message strings
-## environment - Spring Environment object for property resolution
-#set ($serviceName = $rpUIContext.serviceName)
-#set ($rpOrganizationLogo = $rpUIContext.getLogo())
-##
-<!DOCTYPE html>
-<html>
-    <head>
-        <meta charset="UTF-8">
-        <meta name="viewport" content="width=device-width,initial-scale=1.0">
-        <link rel="stylesheet" type="text/css" href="$request.getContextPath()/css/consent.css">
-        <title>#springMessageText("${termsOfUseId}.title", "Terms of Use")</title>
-    </head>
-    <body>
-        <div class="box">
-            <header>
-                <img src="$request.getContextPath()#springMessage("idp.logo")" alt="#springMessageText("idp.logo.alt-text", "logo")" class="federation_logo">
-                #if ($rpOrganizationLogo)
-                    <img src="$encoder.encodeForHTMLAttribute($rpOrganizationLogo)" alt="$encoder.encodeForHTMLAttribute($serviceName)" class="organization_logo">
-                #end
-            </header>
-            #if ($rpOrganizationLogo)
-                <div style="float:left;">
-                    <h1>#springMessageText("${termsOfUseId}.title", "Terms of Use")</h1>
-                </div>
-            #end
-            <div id="tou-content">
-                #springMessageText("${termsOfUseId}.text", "Terms of Use Text...")
-            </div>
-            <div id="tou-acceptance">
-                <div style="float:left;">
-                    <form action="$flowExecutionUrl" method="post" >
-                        #parse("csrf/csrf.vm")
-                        <input type="submit" name="_eventId_TermsRejected" value="#springMessageText("idp.terms-of-use.reject", "Refuse")" style="margin-right: 30px;">
-                    </form>
-                </div>
-                <div style="float:right;">
-                    <form action="$flowExecutionUrl" method="post" >
-                        #parse("csrf/csrf.vm")
-                        <input id="accept" type="checkbox" name="_shib_idp_consentIds" value="$encoder.encodeForHTML($termsOfUseId)" required>
-                        <label for="accept">#springMessageText("idp.terms-of-use.accept", "I accept the terms of use")</label>
-                        #if ($requireCheckbox)
-                            <p class="form-error">#springMessageText("idp.terms-of-use.required", "Please check this box if you want to proceed.")</p>
-                        #end
-                        <input type="submit" name="_eventId_proceed" value="#springMessageText("idp.terms-of-use.submit", "Submit")">
-                    </form>
-                </div>
-                <div style="clear:both;"></div>
-            </div>
-            <footer>
-                <div class="container container-footer">
-                    <p class="footer-text">#springMessageText("idp.footer", "Insert your footer text here.")</p>
-                </div>
-            </footer>
-        </div>
-    </body>
-</html>
diff --git a/views/login.vm b/views/login.vm
index 7609d40..c7b15c9 100644
--- a/views/login.vm
+++ b/views/login.vm
@@ -90,7 +90,7 @@
             #end
 
             #foreach ($extFlow in $extendedAuthenticationFlows)
-              #if ($authenticationContext.isAcceptable($extFlow) and $extFlow.apply(profileRequestContext))
+              #if ($authenticationContext.isAcceptable($extFlow) and $extFlow.test(profileRequestContext))
                 <div class="form-element-wrapper">
                   <button class="form-element form-button" type="submit" name="_eventId_$extFlow.getId()">
                     #springMessageText("idp.login.$extFlow.getId().replace('authn/','')", $extFlow.getId().replace('authn/',''))
diff --git a/views/logout.vm b/views/logout.vm
index 0b9103b..3d8d50b 100644
--- a/views/logout.vm
+++ b/views/logout.vm
@@ -25,13 +25,11 @@
     <head>
         <meta charset="utf-8">
         <meta name="viewport" content="width=device-width,initial-scale=1.0">
-        #*
         #if ($promptForSP)
             <meta http-equiv="refresh" content="10;url=$flowExecutionUrl&_eventId=propagate">
         #elseif ($promptForIdP)
             <meta http-equiv="refresh" content="10;url=$flowExecutionUrl&_eventId=local">
         #end
-        *#
         <title>#springMessageText("idp.title", "Web Login Service")</title>
         <link rel="stylesheet" type="text/css" href="$request.getContextPath()/css/main.css">
     </head>
diff --git a/views/spnego-unavailable.vm b/views/spnego-unavailable.vm
deleted file mode 100644
index 3673f02..0000000
--- a/views/spnego-unavailable.vm
+++ /dev/null
@@ -1,49 +0,0 @@
-##
-## Velocity Template for SPNEGO unauthorized page
-##
-## This is not a Spring Webflow view, but a special view internal to the
-## SPNEGO login flow, so it doesn't contain all of the usual SWF variables.
-##
-## Velocity context will contain the following properties
-## encoder - HTMLEncoder class
-## request - HttpServletRequest
-## response - HttpServletResponse
-## profileRequestContext - root of context tree
-## errorUrl - URL to call to indicate error and return back to the login flow
-##
-#set ($eventKey = $springMacroRequestContext.getMessage("SPNEGOUnavailable", "spnego-unavailable"))
-<!DOCTYPE html>
-<html>
-  <head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width,initial-scale=1.0">
-    <title>#springMessageText("idp.title", "Web Login Sevice") - #springMessageText("${eventKey}.title", "Error")</title>
-    <link rel="stylesheet" type="text/css" href="$request.getContextPath()/css/main.css">
-  </head>
-  
-  <body onload="window.location = '$errorUrl'">
-    <div class="wrapper">
-      <div class="container">
-        <header>
-          <img src="$request.getContextPath()#springMessage("idp.logo")" alt="#springMessageText("idp.logo.alt-text", "logo")">
-          <h3>#springMessageText("idp.title", "Web Login Sevice") - #springMessage("idp.title.suffix", "Error")</h3>
-        </header>
-                
-        <div class="content">
-          #springMessageText("${eventKey}.message", "Your web browser doesn't support authentication with your desktop login credentials.")
-          <ul class="list list-help">
-            <li class="list-help-item">
-              <a href="$errorUrl"><span class="item-marker">&rsaquo;</span> #springMessageText("spnego-unavailable.return", "Cancel the attempt.")</a>
-            </li>
-          </ul>
-        </div>
-      </div>
-
-      <footer>
-        <div class="container container-footer">
-          <p class="footer-text">#springMessageText("idp.footer", "Insert your footer text here.")</p>
-        </div>
-      </footer>
-    </div>
-  </body>
-</html>