diff --git a/Workbench/comanage_data/Dockerfile b/Workbench/comanage_data/Dockerfile
index d8e59a3..05bc6cc 100644
--- a/Workbench/comanage_data/Dockerfile
+++ b/Workbench/comanage_data/Dockerfile
@@ -7,3 +7,6 @@ ENV MYSQL_USER registry_user
 ENV MYSQL_PASSWORD 123321
 ENV MYSQL_DATADIR /var/lib/mysqlmounted
 ENV AFTER_FIRST_TIME_SQL /seed-data/comanage-bootstrap.sql
+
+  
+  
diff --git a/Workbench/docker-compose.yml b/Workbench/docker-compose.yml
index afc1a49..5090b77 100644
--- a/Workbench/docker-compose.yml
+++ b/Workbench/docker-compose.yml
@@ -19,7 +19,7 @@ services:
         aliases:
          - grouper-daemon
     healthcheck:
-      test: curl -s grouper_data:3306
+      test: gsh
       interval: 30s
       timeout: 30s
       retries: 3
@@ -60,6 +60,11 @@ services:
          - grouper-ui
     ports:
      - 8443:443
+    healthcheck:
+      test: curl -k -f https://127.0.0.1/grouper/grouperUi/ || exit 1
+      interval: 30s
+      timeout: 30s
+      retries: 3
     secrets:
      - g_database_password.txt
      - source: grouper.hibernate.properties
@@ -112,6 +117,11 @@ services:
          - grouper-ws
     ports:
      - 9443:443
+    healthcheck:
+      test: curl -k -f https://127.0.0.1/grouper-ws/status?diagnosticType=trivial || exit 1
+      interval: 30s
+      timeout: 30s
+      retries: 3
     secrets:
      - g_database_password.txt
      - source: grouper.hibernate.properties
@@ -147,7 +157,7 @@ services:
     ports:
      - 3306:3306
     healthcheck:
-      test: curl -s grouper_data:3306
+      test: curl -s 127.0.0.1:3306
       interval: 30s
       timeout: 30s
       retries: 3
@@ -160,6 +170,11 @@ services:
      - 389:389
     networks:
      - net
+    healthcheck:
+      test: netstat -an | grep :389 | grep LISTEN
+      interval: 30s
+      timeout: 30s
+      retries: 3
     volumes:
      - ldap:/var/lib/dirsrv
 
@@ -169,6 +184,11 @@ services:
      - 13306:3306
     networks:
      - net
+    healthcheck:
+      test: curl -s 127.0.0.1:3306
+      interval: 30s
+      timeout: 30s
+      retries: 3
     volumes:
      - source_mysql:/var/lib/mysql
      - source_data:/var/lib/mysqlmounted
@@ -183,6 +203,11 @@ services:
       net:
         aliases:
          - comanage-data
+    healthcheck:
+      test: curl -s 127.0.0.1:3306
+      interval: 30s
+      timeout: 30s
+      retries: 3
     volumes:
      - comanage_mysql:/var/lib/mysql
      - comanage_data:/var/lib/mysqlmounted
@@ -197,6 +222,11 @@ services:
       net:
         aliases:
          - midpoint-data
+    healthcheck:
+      test: curl -s 127.0.0.1:3306
+      interval: 30s
+      timeout: 30s
+      retries: 3
     volumes:
      - midpoint_mysql:/var/lib/mysql
      - midpoint_data:/var/lib/mysqlmounted
@@ -260,6 +290,7 @@ services:
         - CSPHOSTNAME
     depends_on:
      - directory
+     - idp_ui
     environment:
      - JETTY_MAX_HEAP=64m
      - JETTY_BROWSER_SSL_KEYSTORE_PASSWORD=password
@@ -278,11 +309,16 @@ services:
       args:
         - CSPHOSTNAME
     depends_on:
-     - idp
+     - idp_ui_data
     networks:
      - net
     ports:
      - 8080:8080
+    healthcheck:
+      test: curl -k -f https://127.0.0.1:8443/idpui/login || exit 1
+      interval: 30s
+      timeout: 30s
+      retries: 3
     volumes:
      - generated-metadata:/generated-metadata
      - generated-config:/generated-config
@@ -300,6 +336,11 @@ services:
       net:
         aliases:
          - idpui-data
+    healthcheck:
+      test: curl -s 127.0.0.1:3306
+      interval: 30s
+      timeout: 30s
+      retries: 3
     volumes:
     - mariadb-data:/var/lib/mysql
     
@@ -312,6 +353,11 @@ services:
      - net
     ports:
      - 15672:15672
+    healthcheck:
+      test: curl -s 127.0.0.1:15672
+      interval: 30s
+      timeout: 30s
+      retries: 3
     volumes:
      - mq:/var/lib/rabbitmq
 
@@ -360,6 +406,11 @@ services:
     build: ./wordpress_data/
     networks:
       - net
+    healthcheck:
+      test: curl -s 127.0.0.1:3306
+      interval: 30s
+      timeout: 30s
+      retries: 3
     volumes:
       - wordpress_data:/var/lib/mysql
     ports:
@@ -381,6 +432,11 @@ services:
      - net
     ports:
      - 11443:443
+    healthcheck:
+      test: curl -kf https://127.0.0.1/registry/ || exit 1
+      interval: 30s
+      timeout: 30s
+      retries: 3
     volumes:
      - type: bind
        source: ./configs-and-secrets/comanage/shibboleth/shibboleth2.xml
@@ -400,6 +456,11 @@ services:
       context: ./comanage_cron/
       args:
         - CSPHOSTNAME
+    healthcheck:
+      test: curl -s comanage_data:3306
+      interval: 30s
+      timeout: 30s
+      retries: 3
     environment:
      - ENV
      - USERTOKEN
diff --git a/Workbench/grouper_data/Dockerfile b/Workbench/grouper_data/Dockerfile
index ed1ebe9..547520e 100644
--- a/Workbench/grouper_data/Dockerfile
+++ b/Workbench/grouper_data/Dockerfile
@@ -35,4 +35,5 @@ RUN (mysqld_safe & ) \
 
 EXPOSE 3306
 
+
 CMD mysqld_safe
diff --git a/Workbench/idp/Dockerfile b/Workbench/idp/Dockerfile
index 119762f..2ab14b2 100644
--- a/Workbench/idp/Dockerfile
+++ b/Workbench/idp/Dockerfile
@@ -9,6 +9,8 @@ COPY shibboleth-idp/ /opt/shibboleth-idp/
 
 RUN mkdir -p /opt/shibboleth-idp/metadata/generated && mkdir -p /opt/shibboleth-idp/conf/generated
 
+COPY container_files/idp/shibui-metadata-providers.xml /opt/shibboleth-idp/conf/generated/
+
 COPY container_files/system/setservername.sh /usr/local/bin/
 RUN chmod 755 /usr/local/bin/setservername.sh
 
diff --git a/Workbench/idp/container_files/idp/shibui-metadata-providers.xml b/Workbench/idp/container_files/idp/shibui-metadata-providers.xml
new file mode 100644
index 0000000..0307448
--- /dev/null
+++ b/Workbench/idp/container_files/idp/shibui-metadata-providers.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<MetadataProvider xmlns="urn:mace:shibboleth:2.0:metadata"
+                	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                	id="ShibbolethMetadata"
+                	xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd urn:mace:shibboleth:2.0:resource http://shibboleth.net/schema/idp/shibboleth-resource.xsd urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd urn:oasis:names:tc:SAML:2.0:assertion http://docs.oasis-open.org/security/saml/v2.0/saml-schema-assertion-2.0.xsd"
+                	xsi:type="ChainingMetadataProvider"/>
diff --git a/Workbench/idp/shibboleth-idp/conf/attribute-filter.xml b/Workbench/idp/shibboleth-idp/conf/attribute-filter.xml
index c956985..22a874a 100644
--- a/Workbench/idp/shibboleth-idp/conf/attribute-filter.xml
+++ b/Workbench/idp/shibboleth-idp/conf/attribute-filter.xml
@@ -37,4 +37,70 @@
 		<AttributeRule attributeID="mail" permitAny="true" />
     </AttributeFilterPolicy>
 	
+	<!-- Supports annotated metadata supplied by the Shibb UI -->
+	<AttributeFilterPolicy id="Per-Attribute-singleValued">
+        <PolicyRequirementRule xsi:type="ANY"/>
+        <AttributeRule attributeID="eduPersonPrincipalName">
+            <PermitValueRule xsi:type="EntityAttributeExactMatch"
+                             attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+                             attributeValue="eduPersonPrincipalName" />
+        </AttributeRule>
+        <AttributeRule attributeID="uid">
+            <PermitValueRule xsi:type="EntityAttributeExactMatch"
+                             attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+                             attributeValue="uid" />
+        </AttributeRule>
+        <AttributeRule attributeID="mail">
+            <PermitValueRule xsi:type="EntityAttributeExactMatch"
+                             attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+                             attributeValue="mail" />
+        </AttributeRule>
+        <AttributeRule attributeID="surname">
+            <PermitValueRule xsi:type="EntityAttributeExactMatch"
+                             attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+                             attributeValue="surname" />
+        </AttributeRule>
+        <AttributeRule attributeID="givenName">
+            <PermitValueRule xsi:type="EntityAttributeExactMatch"
+                             attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+                             attributeValue="givenName" />
+        </AttributeRule>
+        <AttributeRule attributeID="eduPersonAffiliation">
+            <PermitValueRule xsi:type="EntityAttributeExactMatch"
+                             attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+                             attributeValue="eduPersonAffiliation" />
+        </AttributeRule>
+        <AttributeRule attributeID="eduPersonScopedAffiliation">
+            <PermitValueRule xsi:type="EntityAttributeExactMatch"
+                             attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+                             attributeValue="eduPersonScopedAffiliation" />
+        </AttributeRule>
+        <AttributeRule attributeID="eduPersonPrimaryAffiliation">
+            <PermitValueRule xsi:type="EntityAttributeExactMatch"
+                             attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+                             attributeValue="eduPersonPrimaryAffiliation" />
+        </AttributeRule>
+        <AttributeRule attributeID="eduPersonEntitlement">
+            <PermitValueRule xsi:type="EntityAttributeExactMatch"
+                             attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+                             attributeValue="eduPersonEntitlement" />
+        </AttributeRule>
+        <AttributeRule attributeID="eduPersonAssurance">
+            <PermitValueRule xsi:type="EntityAttributeExactMatch"
+                             attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+                             attributeValue="eduPersonAssurance" />
+        </AttributeRule>
+        <AttributeRule attributeID="eduPersonUniqueId">
+            <PermitValueRule xsi:type="EntityAttributeExactMatch"
+                             attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+                             attributeValue="eduPersonUniqueId" />
+        </AttributeRule>
+        <AttributeRule attributeID="employeeNumber">
+            <PermitValueRule xsi:type="EntityAttributeExactMatch"
+                             attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+                             attributeValue="employeeNumber" />
+        </AttributeRule>
+    </AttributeFilterPolicy>
+	
+	
 </AttributeFilterPolicyGroup>
diff --git a/Workbench/idp/shibboleth-idp/conf/metadata-providers.xml b/Workbench/idp/shibboleth-idp/conf/metadata-providers.xml
index 2992635..d6c3202 100644
--- a/Workbench/idp/shibboleth-idp/conf/metadata-providers.xml
+++ b/Workbench/idp/shibboleth-idp/conf/metadata-providers.xml
@@ -30,6 +30,14 @@
     <MetadataProvider id="ComanageSP"  xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/comanage-sp.xml"/>
     <MetadataProvider id="ProxySP"  xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/proxy-sp.xml"/>
 	<MetadataProvider id="ShibUISP"  xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/idpui-sp.xml"/>
+	
+	<!-- For metadata generated by the Shib UI -->
+	<MetadataProvider id="LocalDynamic"
+                      xsi:type="LocalDynamicMetadataProvider"
+                      sourceDirectory="%{idp.home}/metadata/generated"
+                      minCacheDuration="PT10S"
+                      maxCacheDuration="PT30S"/>
+					  
 
     <!-- Example HTTP metadata provider.  Use this if you want to download
          the metadata from a remote service.
diff --git a/Workbench/idp/shibboleth-idp/conf/relying-party.xml b/Workbench/idp/shibboleth-idp/conf/relying-party.xml
new file mode 100644
index 0000000..b7c17d1
--- /dev/null
+++ b/Workbench/idp/shibboleth-idp/conf/relying-party.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+       xmlns:context="http://www.springframework.org/schema/context"
+       xmlns:util="http://www.springframework.org/schema/util"
+       xmlns:p="http://www.springframework.org/schema/p"
+       xmlns:c="http://www.springframework.org/schema/c"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+                           
+       default-init-method="initialize"
+       default-destroy-method="destroy">
+
+    <!--
+    Unverified RP configuration, defaults to no support for any profiles. Add <ref> elements to the list
+    to enable specific default profile settings (as below), or create new beans inline to override defaults.
+    
+    "Unverified" typically means the IdP has no metadata, or equivalent way of assuring the identity and
+    legitimacy of a requesting system. To run an "open" IdP, you can enable profiles here.
+    -->
+    <bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">
+        <property name="profileConfigurations">
+            <list>
+            <!-- <bean parent="SAML2.SSO" p:encryptAssertions="false" /> -->
+            </list>
+        </property>
+    </bean>
+
+    <!--
+    Default configuration, with default settings applied for all profiles, and enables
+    the attribute-release consent flow.
+    -->
+    <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
+        <property name="profileConfigurations">
+            <list>
+                <!-- SAML 1.1 and SAML 2.0 AttributeQuery are disabled by default. -->
+                <!--
+                <bean parent="Shibboleth.SSO" p:postAuthenticationFlows="attribute-release" />
+                <ref bean="SAML1.AttributeQuery" />
+                <ref bean="SAML1.ArtifactResolution" />
+                -->
+				<bean parent="SAML2.SSO.MDDriven" p:postAuthenticationFlows="attribute-release"/>
+                <!-- <bean parent="SAML2.SSO" p:postAuthenticationFlows="attribute-release" /> -->
+                <ref bean="SAML2.ECP" />
+                <ref bean="SAML2.Logout" />
+                <!--
+                <ref bean="SAML2.AttributeQuery" />
+                -->
+                <ref bean="SAML2.ArtifactResolution" />
+                <ref bean="Liberty.SSOS" />
+            </list>
+        </property>
+    </bean>
+
+    <!-- Container for any overrides you want to add. -->
+
+    <util:list id="shibboleth.RelyingPartyOverrides">
+    
+        <!--
+        Override example that identifies a single RP by name and configures it
+        for SAML 2 SSO without encryption. This is a common "vendor" scenario.
+        -->
+        <!--
+        <bean parent="RelyingPartyByName" c:relyingPartyIds="https://sp.example.org">
+            <property name="profileConfigurations">
+                <list>
+                    <bean parent="SAML2.SSO" p:encryptAssertions="false" />
+                </list>
+            </property>
+        </bean>
+        -->
+        
+    </util:list>
+
+</beans>
\ No newline at end of file
diff --git a/Workbench/idp/shibboleth-idp/conf/services.xml b/Workbench/idp/shibboleth-idp/conf/services.xml
new file mode 100644
index 0000000..e5cceb5
--- /dev/null
+++ b/Workbench/idp/shibboleth-idp/conf/services.xml
@@ -0,0 +1,70 @@
+<beans xmlns="http://www.springframework.org/schema/beans"
+    xmlns:context="http://www.springframework.org/schema/context"
+    xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
+    xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+                           
+    default-init-method="initialize"
+    default-destroy-method="destroy">
+                               
+    <!-- By default we look at resources whose names are derived from %{idp.home}. -->
+
+    <!-- This set of resources supports a native Spring relying-party.xml file. -->
+    <util:list id="shibboleth.RelyingPartyResolverResources">
+        <value>%{idp.home}/conf/relying-party.xml</value>
+        <value>%{idp.home}/conf/credentials.xml</value>
+        <value>%{idp.home}/system/conf/relying-party-system.xml</value>
+    </util:list>
+
+    <util:list id="shibboleth.MetadataResolverResources">
+        <value>%{idp.home}/conf/metadata-providers.xml</value>
+		<value>%{idp.home}/conf/generated/shibui-metadata-providers.xml</value>
+        <value>%{idp.home}/system/conf/metadata-providers-system.xml</value>
+    </util:list>
+
+    <util:list id ="shibboleth.AttributeResolverResources">
+        <value>%{idp.home}/conf/attribute-resolver.xml</value>
+    </util:list>
+
+    <!--
+    This is suitable for new installs but will usually produce duplicate Attribute
+    output if a legacy resolver file is used that contains AttributeEncoders.
+    -->
+    <util:list id ="shibboleth.AttributeRegistryResources">
+        <value>%{idp.home}/conf/attribute-registry.xml</value>
+        <value>%{idp.home}/system/conf/attribute-registry-system.xml</value>
+        <value>%{idp.home}/conf/attributes/default-rules.xml</value>
+        <value>%{idp.home}/conf/attribute-resolver.xml</value>
+    </util:list>
+
+    <util:list id ="shibboleth.AttributeFilterResources">
+        <value>%{idp.home}/conf/attribute-filter.xml</value>
+    </util:list>
+
+    <util:list id ="shibboleth.NameIdentifierGenerationResources">
+        <value>%{idp.home}/conf/saml-nameid.xml</value>
+        <value>%{idp.home}/system/conf/saml-nameid-system.xml</value>
+    </util:list>
+    
+    <util:list id="shibboleth.AccessControlResources">
+        <value>%{idp.home}/conf/access-control.xml</value>
+        <value>%{idp.home}/system/conf/access-control-system.xml</value>
+    </util:list>
+
+    <util:list id="shibboleth.CASServiceRegistryResources">
+        <value>%{idp.home}/conf/cas-protocol.xml</value>
+    </util:list>
+
+    <!--
+    This collection of resources differs slightly in that it should not include the file extension.
+    Message sources are internationalized, and Spring will search for a compatible language extension
+    and fall back to one with only a .properties extension.
+    -->
+    <util:list id="shibboleth.MessageSourceResources">
+        <value>%{idp.home}/messages/messages</value>
+        <value>%{idp.home}/system/messages/messages</value>
+    </util:list>
+    
+</beans>
\ No newline at end of file
diff --git a/Workbench/idp_ui/Dockerfile b/Workbench/idp_ui/Dockerfile
index 8fddd63..bd0f366 100644
--- a/Workbench/idp_ui/Dockerfile
+++ b/Workbench/idp_ui/Dockerfile
@@ -8,12 +8,11 @@ COPY container_files/idp_ui/shibui-test.p12 /opt/shibui/
 COPY container_files/idp_ui/users.txt /opt/shibui/
 
 RUN mkdir -p /opt/shibui/saml/
-COPY container_files/idp_ui/samlkeystore.jks /opt/shibui/saml/
+#COPY container_files/idp_ui/samlkeystore.jks /opt/shibui/saml/
 COPY container_files/idp_ui/idp-metadata.xml /opt/shibui/saml/
 
 COPY container_files/system/setservername.sh /usr/local/bin/
 RUN chmod 755 /usr/local/bin/setservername.sh
 RUN /usr/local/bin/setservername.sh
-
-
+  
 EXPOSE 8443
diff --git a/Workbench/idp_ui/container_files/idp_ui/application.yml b/Workbench/idp_ui/container_files/idp_ui/application.yml
index 071d668..04be8c9 100644
--- a/Workbench/idp_ui/container_files/idp_ui/application.yml
+++ b/Workbench/idp_ui/container_files/idp_ui/application.yml
@@ -14,7 +14,7 @@ server:
 shibui:
   default-password: "{noop}letmein7"
   metadataProviders:
-    target: "file:/generated-conf/shibui-metadata-providers.xml"
+    target: "file:/generated-config/shibui-metadata-providers.xml"
   metadata-dir: "/generated-metadata"
   beacon-enabled: true
   pac4j-enabled: false