diff --git a/Workbench/configs-and-secrets/grouper/shibboleth/shibboleth2.xml b/Workbench/configs-and-secrets/grouper/shibboleth/shibboleth2.xml
index 6389055..1d514fb 100755
--- a/Workbench/configs-and-secrets/grouper/shibboleth/shibboleth2.xml
+++ b/Workbench/configs-and-secrets/grouper/shibboleth/shibboleth2.xml
@@ -54,7 +54,7 @@
             <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
 
             <!-- Status reporting service. -->
-            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
+            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1 172.16.0.0/12"/>
 
             <!-- Session diagnostic service. -->
             <Handler type="Session" Location="/Session" showAttributeValues="true"/>
diff --git a/Workbench/idp/shibboleth-idp/conf/access-control.xml b/Workbench/idp/shibboleth-idp/conf/access-control.xml
new file mode 100644
index 0000000..17aea1c
--- /dev/null
+++ b/Workbench/idp/shibboleth-idp/conf/access-control.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+       xmlns:context="http://www.springframework.org/schema/context"
+       xmlns:util="http://www.springframework.org/schema/util"
+       xmlns:p="http://www.springframework.org/schema/p"
+       xmlns:c="http://www.springframework.org/schema/c"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+                           
+       default-init-method="initialize"
+       default-destroy-method="destroy">
+
+    <!--
+    Map of access control policies used to limit access to administrative functions.
+    The purpose of the map is to label policies with a key/name so they can be reused.
+    -->
+
+    <!--
+    Use the "shibboleth.IPRangeAccessControl" parent bean for IP-based access control.
+    The ranges provided MUST be CIDR network expressions. To specify a single address,
+    add "/32" or "/128" for IPv4 or IPv6 respectively.
+
+    The additional examples below demonstrate how to control access by username
+    and by attribute(s), in the case of authenticated access to admin functions.
+    -->
+
+    <util:map id="shibboleth.AccessControlPolicies">
+    
+        <entry key="AccessByIPAddress">
+            <bean id="AccessByIPAddress" parent="shibboleth.IPRangeAccessControl"
+                p:allowedRanges="#{ {'127.0.0.1/32', '::1/128', '172.16.0.0/12'} }" />
+        </entry>
+        
+        <!--
+        <entry key="AccessByUser">
+            <bean parent="shibboleth.PredicateAccessControl">
+                <constructor-arg>
+                    <bean parent="shibboleth.Conditions.SubjectName" c:collection="#{'jdoe'}" />
+                </constructor-arg>
+            </bean>
+        </entry>
+        -->
+        
+        <!--
+        <entry key="AccessByAttribute">
+            <bean parent="shibboleth.PredicateAccessControl">
+                <constructor-arg>
+                    <bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate">
+                        <property name="attributeValueMap">
+                            <map>
+                                <entry key="eduPersonEntitlement">
+                                    <list>
+                                        <value>https://example.org/entitlement/idpadmin</value>
+                                    </list>
+                                </entry>
+                            </map>
+                        </property>
+                    </bean>
+                </constructor-arg>
+            </bean>
+        </entry>
+        -->
+    
+    </util:map>
+
+</beans>
+
diff --git a/Workbench/webproxy/Dockerfile b/Workbench/webproxy/Dockerfile
index c07c899..98f78cc 100644
--- a/Workbench/webproxy/Dockerfile
+++ b/Workbench/webproxy/Dockerfile
@@ -1,4 +1,5 @@
 FROM tier/shibboleth_sp:latest
 
 COPY container_files/httpd/proxy.conf /etc/httpd/conf.d/
+COPY container_files/httpd/index.html /var/www/html/
 
diff --git a/Workbench/webproxy/container_files/httpd/index.html b/Workbench/webproxy/container_files/httpd/index.html
new file mode 100644
index 0000000..1160f0c
--- /dev/null
+++ b/Workbench/webproxy/container_files/httpd/index.html
@@ -0,0 +1,18 @@
+<br />
+<h3>Welcome to the InCommon TAP Workbench!</h3>
+<br />
+This is your own personal instance of the InCommon <i>Trusted Access Platform</i> Workbench.
+<br /><br />
+It is running on your local machine.
+<br /><br />
+For more information, see <a href="https://spaces.at.internet2.edu/display/MID/Grouper+integration+demo#Grouperintegrationdemo-CheckingthemidPointstate(optional)" target="_blank">this page</a>.
+<br /><br />
+The system contains the following TAP components (click the links to access each component in its own tab):
+<ul>
+<li><a href="https://localhost/idp/status" target="TAP-WB-IDP">Shibboleth IdP</a></li>
+<li><a href="https://localhost/grouperSSO/Shibboleth.sso/Status" target="TAP-WB-SP">Shibboleth SP</a></li>
+<li><a href="https://localhost/grouper" target="TAP-WB-GROUPER">Grouper</a></li>
+<li><a href="https://localhost/midpoint" target="TAP-WB-MIDPOINT">midPoint</a></li>
+<li>COmanage (coming soon)</li>
+</ul>
+