diff --git a/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/shibboleth2.xml b/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/shibboleth2.xml
deleted file mode 100644
index 0c38f82..0000000
--- a/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/shibboleth2.xml
+++ /dev/null
@@ -1,136 +0,0 @@
-<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
-    xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
-    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
-    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"    
-    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
-    clockSkew="180">
-
-    <!--
-    By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
-    are used. See example-shibboleth2.xml for samples of explicitly configuring them.
-    -->
-
-    <!--
-    To customize behavior for specific resources on Apache, and to link vhosts or
-    resources to ApplicationOverride settings below, use web server options/commands.
-    See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements for help.
-    
-    For examples with the RequestMap XML syntax instead, see the example-shibboleth2.xml
-    file, and the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo topic.
-    -->
-    <TCPListener address="127.0.0.1" port="1600"/> 
-
-
-    <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
-    <ApplicationDefaults entityID="https://grouperdemo/shibboleth"
-                         REMOTE_USER="uid">
-
-        <!--
-        Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
-        You MUST supply an effectively unique handlerURL value for each of your applications.
-        The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
-        a relative value based on the virtual host. Using handlerSSL="true", the default, will force
-        the protocol to be https. You should also set cookieProps to "https" for SSL-only sites.
-        Note that while we default checkAddress to "false", this has a negative impact on the
-        security of your site. Stealing sessions via cookie theft is much easier with this disabled.
-        -->
-        <Sessions lifetime="28800" timeout="28800" relayState="ss:mem"
-                  checkAddress="false" handlerSSL="true" cookieProps="https">
-
-            <!--
-            Configures SSO for a default IdP. To allow for >1 IdP, remove
-            entityID property and adjust discoveryURL to point to discovery service.
-            (Set discoveryProtocol to "WAYF" for legacy Shibboleth WAYF support.)
-            You can also override entityID on /Login query string, or in RequestMap/htaccess.
-            -->
-		<SSO entityID="https://idptestbed/idp/shibboleth">
-			SAML2
-		</SSO>
-
-            <!-- SAML and local-only logout. -->
-            <Logout>SAML2 Local</Logout>
-            
-            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
-            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
-
-            <!-- Status reporting service. -->
-            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
-
-            <!-- Session diagnostic service. -->
-            <Handler type="Session" Location="/Session" showAttributeValues="true"/>
-
-            <!-- JSON feed of discovery information. -->
-            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
-        </Sessions>
-
-        <!--
-        Allows overriding of error template information/filenames. You can
-        also add attributes with values that can be plugged into the templates.
-        -->
-        <Errors supportContact="root@localhost"
-            helpLocation="/about.html"
-            styleSheet="/shibboleth-sp/main.css"/>
-        
-        <!-- Example of remotely supplied batch of signed metadata. -->
-        <!--
-        <MetadataProvider type="XML" validate="true"
-	      uri="http://example.org/federation-metadata.xml"
-              backingFilePath="federation-metadata.xml" reloadInterval="7200">
-            <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
-            <MetadataFilter type="Signature" certificate="fedsigner.pem"/>
-            <DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true" 
-              attributeName="http://macedir.org/entity-category"
-              attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
-              attributeValue="http://refeds.org/category/hide-from-discovery" />
-        </MetadataProvider>
-        -->
-
-        <MetadataProvider type="XML" validate="true" file="idp-metadata.xml"/>
-
-        <!--
-        InCommon
-	  <MetadataProvider type="XML" validate="true"
-		uri="http://md.incommon.org/InCommon/InCommon-metadata.xml"
-              backingFilePath="federation-metadata.xml" reloadInterval="7200">
-            <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
-		<MetdataFilter type="Signature" certificate="inc-md-cert.pem"/>
-            <DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true" 
-              attributeName="http://macedir.org/entity-category"
-              attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
-              attributeValue="http://refeds.org/category/hide-from-discovery" />
-        </MetadataProvider>
-        -->
-
-        <!-- Map to extract attributes from SAML assertions. -->
-        <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
-        
-        <!-- Use a SAML query if no attributes are supplied during SSO. -->
-        <AttributeResolver type="Query" subjectMatch="true"/>
-
-        <!-- Default filtering policy for recognized attributes, lets other data pass. -->
-        <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
-
-        <!-- Simple file-based resolver for using a single keypair. -->
-        <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
-
-        <!--
-        The default settings can be overridden by creating ApplicationOverride elements (see
-        the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride topic).
-        Resource requests are mapped by web server commands, or the RequestMapper, to an
-        applicationId setting.
-        
-        Example of a second application (for a second vhost) that has a different entityID.
-        Resources on the vhost would map to an applicationId of "admin":
-        -->
-        <!--
-        <ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/>
-        -->
-    </ApplicationDefaults>
-    
-    <!-- Policies that determine how to process and authenticate runtime messages. -->
-    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
-
-    <!-- Low-level configuration about protocols and bindings available for use. -->
-    <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
-
-</SPConfig>
diff --git a/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/sp-cert.pem b/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/sp-cert.pem
deleted file mode 100644
index 9cc228a..0000000
--- a/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/sp-cert.pem
+++ /dev/null
@@ -1,20 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDPDCCAiQCCQDNZe8r0hVtuTANBgkqhkiG9w0BAQUFADBgMQswCQYDVQQGEwJV
-UzELMAkGA1UECAwCTUkxEjAQBgNVBAcMCUFubiBBcmJvcjEXMBUGA1UECgwOSW50
-ZXJuZXQyL1RJRVIxFzAVBgNVBAMMDnNwLmV4YW1wbGUub3JnMB4XDTE3MDkyMjE5
-NTAzNVoXDTI3MDkyMDE5NTAzNVowYDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk1J
-MRIwEAYDVQQHDAlBbm4gQXJib3IxFzAVBgNVBAoMDkludGVybmV0Mi9USUVSMRcw
-FQYDVQQDDA5zcC5leGFtcGxlLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
-AQoCggEBAMTNJmsNpTpR4NrDJwOgK/o3UYlNdi1c6xBflt+liLAsQc160QReV4dS
-SGK8LZvN58a/BTIsH8dLhQlUQ8qQUY2AfolVrNxb7Waumeh/POzYUTRylnoGpU3W
-bGMEPxE/AdgP5U/adYvyu4XI5epv7wjZJOTqcVag15SalY+aso+ZC/5l+UzRxmWB
-ZxKTsSL1y7PFehY4/Zl3Y3oGVsVl/zspt5lteoZQeeVxUX29S3Af11yHY4xpEp+7
-rvAzY/nlsTiHAsUoCFK/NFQ2evvSRx52B9Fk1cWP1MDVDm2QjQqD9xBGYSnX6bhQ
-ejVx7JUJHlblu2Q5p5XdW0BihgFluoECAwEAATANBgkqhkiG9w0BAQUFAAOCAQEA
-n/qhYnIviPs4tglCdrw+M7gbqKNWadDC3F9HDYzlJMFeS/ae2turhEUgQPbYPDQQ
-eO3oOILtvCXNFUPM58jf8V5YFRrOqrTgx44kexQDaHO5YYNft5tF5TdvBYE2gOVr
-GdYrH2iSP8WX+Yy7JH5uqkfwWzEntWHJdey39rCWKAUCCB35+/2b4N53Qmlv2+ug
-CpNJYFtXInd4YMmM5HjXLyoWXtjnKiwDqYUCeYPSwAajnCqRqRXUX0gYTFDRiwRP
-HbmO9We0nqoc/71nikmGGoSRMO/zWVMFjwmAx1fGiWdU61sjGX8sHifzmVyJVEBI
-Z75p+JrWYZJYrx/vpWxL8g==
------END CERTIFICATE-----
diff --git a/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/sp-key.pem b/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/sp-key.pem
deleted file mode 100644
index 1b0b579..0000000
--- a/grouper-midpoint/mp-gr/configs-and-secrets/shibboleth/sp-key.pem
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDEzSZrDaU6UeDa
-wycDoCv6N1GJTXYtXOsQX5bfpYiwLEHNetEEXleHUkhivC2bzefGvwUyLB/HS4UJ
-VEPKkFGNgH6JVazcW+1mrpnofzzs2FE0cpZ6BqVN1mxjBD8RPwHYD+VP2nWL8ruF
-yOXqb+8I2STk6nFWoNeUmpWPmrKPmQv+ZflM0cZlgWcSk7Ei9cuzxXoWOP2Zd2N6
-BlbFZf87KbeZbXqGUHnlcVF9vUtwH9dch2OMaRKfu67wM2P55bE4hwLFKAhSvzRU
-Nnr70kcedgfRZNXFj9TA1Q5tkI0Kg/cQRmEp1+m4UHo1ceyVCR5W5btkOaeV3VtA
-YoYBZbqBAgMBAAECggEAA/5t0ypZug9DUu0283niqpdIzlKGHXGPS6vE8hD37ytW
-wobFiyMm/5YJ5gcPnePV2lCyGEyQ8Ih10LSnE4tOPGLpLnxQn8A11ymf8fnzEJNr
-Qnc42o0b+bJqTLAfX4g5z1qzOqWiUQ7CA3sKP3G6FiHh/8tKNYnaFif09Q8cpJFb
-YDDkvm48NJgsrIoCgmaFIQIn+yDzGQKWwTNMIks+RByWpc67j1x1kiyQM1RfrEev
-Yyq/ZkP66IYZzmZKpFCWGs5qbRZdxyXNpq85DjwA99lAH7vxtMJHQM4z1h1eDH4L
-Ma5hEnmmHu4D5lF2GDQYflvuFdDGH5tThO6MV0IrSQKBgQD+kvEtNxJCMxLOVFyV
-NWF3pk/i2nkD+53t/VPXjMPtW7IesouEGzU82I/fT2wUTkNwFdkVpv37qoLypKZm
-npJFxr6abQNjiDh2Fsh8/iuJfvdZUFJbCEY6NS58qgjix8XCQKRD06EugK7uekIZ
-zJnttF3qVBBD8Z8Uwxz8i+jF1wKBgQDF51y/5XB6Bz47cdxw7P8NsfnTz2V3H0HU
-OnlEBANbhmBadjU8dqbM54Nxbn7VOdooXPuSnAKJ9vPDg1n5Y/GO+lgldNzfyK6g
-HnbldSu0zBvAaGvmAjLjetEtOkBqYkrHJlT6JAems/Kc/YX5uooAz9/jNJFXP9++
-KbjH3CzHZwKBgQC6ppxEDZPKi83nD/2NvMTIyFzcNFj0LaEepFW7vc7NkiSn0zrt
-0lEXWqUqEv5oaPWTEcHH2VdxFRTLuSL0LKGMnWqUqQcKDA9xrcSzuFvNhRTwHC81
-5XwwI1wBNV4sgFKj2WdW/6y2/szDt0oNxnC50zvkmlwOpPKBc4kmNaKmowKBgBmC
-uXIDIXyZcmw3QTNNWZNqXcnv8iRo4xN4dilOWyBxMfp3QmWI5feD4G2+0Jqr2nNZ
-iRRdB/bA3qtVQ0PinkDQBIzPg6lVNS1uv+TUNc4YgXtL+pyrq+Om8U/jMmqEQR9q
-0YltG49houSZyatnYGK6aSHgpNuaYD0jI66fsyYBAoGAMefyD0I/ncArjuf58hVQ
-zSjxfcvlja9okrC8ZgqsVluezcm4rQNcSjBnESGTCjJC7O29AofGLHkvnsBQDiGk
-hE38IRisd+okXdApr41ifWDhmtASud5q6wlhOpMmQxg+OALf1rTvFYhbnFEXV/KY
-e5A4iXLRIbxbmXZDa35Rebw=
------END PRIVATE KEY-----
diff --git a/grouper-midpoint/mp-gr/midpoint-server/Dockerfile b/grouper-midpoint/mp-gr/midpoint-server/Dockerfile
index 3f1c43e..e9c939f 100644
--- a/grouper-midpoint/mp-gr/midpoint-server/Dockerfile
+++ b/grouper-midpoint/mp-gr/midpoint-server/Dockerfile
@@ -9,33 +9,41 @@ MAINTAINER info@evolveum.com
 RUN rpm --import http://repos.azulsystems.com/RPM-GPG-KEY-azulsystems
 RUN curl -o /etc/yum.repos.d/zulu.repo http://repos.azulsystems.com/rhel/zulu.repo
 RUN yum -y update
-RUN yum -y install zulu-8
-
-RUN yum -y install supervisor
-COPY container_files/supervisor/supervisord.conf /etc/supervisord.conf
-
-RUN rm /etc/shibboleth/sp-key.pem /etc/shibboleth/sp-cert.pem /etc/httpd/conf.d/ssl.conf
-
+RUN yum -y install \
+ 	zulu-8 \
+        cron \
+        supervisor \
+	libcurl \
+	&& yum clean -y all
+
+RUN rm /etc/shibboleth/sp-key.pem /etc/shibboleth/sp-cert.pem \
+    && cd /etc/httpd/conf.d/ \
+    && rm -f autoindex.conf ssl.conf userdir.conf welcome.conf
+
+COPY container_files/supervisor/supervisord.conf /etc/supervisor/supervisord.conf
 COPY container_files/httpd/conf/* /etc/httpd/conf.d/
 COPY container_files/httpd/possible-conf/* /etc/httpd/possible-conf/
 COPY container_files/shibboleth/* /etc/shibboleth/
 COPY container_files/usr-local-bin/ /usr/local/bin/
 
+RUN mv /usr/local/bin/setenv.sh /opt/tier/setenv.sh \
+    && chmod 755 /opt/tier/setenv.sh
+
+RUN chmod 755 /usr/local/bin/sendtierbeacon.sh \
+    && chmod 755 /usr/local/bin/setupcron.sh \
+    && chmod 755 /usr/local/bin/init.sh \
+    && chmod 755 /usr/local/bin/library.sh \
+    && chmod 755 /usr/local/bin/startup.sh \
+    && /usr/local/bin/setupcron.sh
+
 RUN cp /dev/null /etc/httpd/conf.d/ssl.conf \
     && sed -i 's/LogFormat "/LogFormat "httpd;access_log;%{ENV}e;%{USERTOKEN}e;/g' /etc/httpd/conf/httpd.conf \
     && echo -e "\nErrorLogFormat \"httpd;error_log;%{ENV}e;%{USERTOKEN}e;[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i\"" >> /etc/httpd/conf/httpd.conf \
-    && sed -i 's/CustomLog "logs\/access_log"/CustomLog "\/dev\/fd\/1"/g' /etc/httpd/conf/httpd.conf \
-    && sed -i 's/ErrorLog "logs\/error_log"/ErrorLog "\/dev\/fd\/1"/g' /etc/httpd/conf/httpd.conf \
+    && sed -i 's/CustomLog "logs\/access_log"/CustomLog "\/tmp\/loghttpd"/g' /etc/httpd/conf/httpd.conf \
+    && sed -i 's/ErrorLog "logs\/error_log"/ErrorLog "\/tmp\/loghttpd"/g' /etc/httpd/conf/httpd.conf \
     && echo -e "\nPassEnv ENV" >> /etc/httpd/conf/httpd.conf \
     && echo -e "\nPassEnv USERTOKEN" >> /etc/httpd/conf/httpd.conf
 
-
-
-
-# TODO switch to other appropriate Java implementation
-
-
-
 ARG MP_VERSION=3.9-SNAPSHOT
 ARG MP_DIST_FILE=midpoint-${MP_VERSION}-dist.tar.gz
 
@@ -65,4 +73,8 @@ ENV AJP_ENABLED true
 ENV AJP_PORT 9090
 ENV LOGOUT_URL https://localhost:4438/Shibboleth.sso/Logout
 
-CMD ["/usr/bin/supervisord"]
+ENV TIER_RELEASE=test-non-release
+ENV TIER_MAINTAINER=tier
+
+#CMD ["/usr/bin/supervisord"]
+CMD ["/usr/local/bin/startup.sh"]
diff --git a/grouper-midpoint/mp-gr/midpoint-server/container_files/shibboleth/native.logger b/grouper-midpoint/mp-gr/midpoint-server/container_files/shibboleth/native.logger
index 814812f..1a330fd 100644
--- a/grouper-midpoint/mp-gr/midpoint-server/container_files/shibboleth/native.logger
+++ b/grouper-midpoint/mp-gr/midpoint-server/container_files/shibboleth/native.logger
@@ -28,12 +28,12 @@ log4j.category.XMLTooling.libcurl=INFO
 # define the appender
 
 log4j.appender.native_log=org.apache.log4j.FileAppender
-log4j.appender.native_log.fileName=/dev/fd/6
+log4j.appender.native_log.fileName=/tmp/logshib
 log4j.appender.native_log.layout=org.apache.log4j.PatternLayout
 log4j.appender.native_log.layout.ConversionPattern=shibd;native.log;${ENV};${USERTOKEN};%d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n
 
 log4j.appender.warn_log=org.apache.log4j.FileAppender
-log4j.appender.warn_log.fileName=/dev/fd/7
+log4j.appender.warn_log.fileName=/tmp/logshib
 log4j.appender.warn_log.layout=org.apache.log4j.PatternLayout
 log4j.appender.warn_log.layout.ConversionPattern=shibd;native_warn.log;${ENV};${USERTOKEN};%d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n
 log4j.appender.warn_log.threshold=WARN
diff --git a/grouper-midpoint/mp-gr/midpoint-server/container_files/shibboleth/shibd.logger b/grouper-midpoint/mp-gr/midpoint-server/container_files/shibboleth/shibd.logger
index d91e25e..e211857 100644
--- a/grouper-midpoint/mp-gr/midpoint-server/container_files/shibboleth/shibd.logger
+++ b/grouper-midpoint/mp-gr/midpoint-server/container_files/shibboleth/shibd.logger
@@ -42,18 +42,18 @@ log4j.additivity.Shibboleth-TRANSACTION=false
 # define the appenders
 
 log4j.appender.shibd_log=org.apache.log4j.FileAppender
-log4j.appender.shibd_log.fileName=/dev/fd/3
+log4j.appender.shibd_log.fileName=/tmp/logshib
 log4j.appender.shibd_log.maxFileSize=0
 log4j.appender.shibd_log.layout=org.apache.log4j.PatternLayout
 log4j.appender.shibd_log.layout.ConversionPattern=shibd;shibd.log;${ENV};${USERTOKEN};%d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n
 
 log4j.appender.tran_log=org.apache.log4j.FileAppender
-log4j.appender.tran_log.fileName=/dev/fd/4
+log4j.appender.tran_log.fileName=/tmp/logshib
 log4j.appender.tran_log.maxFileSize=0
 log4j.appender.tran_log.layout=org.apache.log4j.PatternLayout
 log4j.appender.tran_log.layout.ConversionPattern=shibd;transaction.log;${ENV};${USERTOKEN};%d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n
 
 log4j.appender.sig_log=org.apache.log4j.FileAppender
-log4j.appender.sig_log.fileName=/dev/fd/5
+log4j.appender.sig_log.fileName=/tmp/logshib
 log4j.appender.sig_log.layout=org.apache.log4j.PatternLayout
 log4j.appender.sig_log.layout.ConversionPattern=shibd;signature.log;${ENV};${USERTOKEN};%m
diff --git a/grouper-midpoint/mp-gr/midpoint-server/container_files/supervisor/supervisord.conf b/grouper-midpoint/mp-gr/midpoint-server/container_files/supervisor/supervisord.conf
index 64a201e..d3a9d03 100644
--- a/grouper-midpoint/mp-gr/midpoint-server/container_files/supervisor/supervisord.conf
+++ b/grouper-midpoint/mp-gr/midpoint-server/container_files/supervisor/supervisord.conf
@@ -1,16 +1,15 @@
 [supervisord]
+logfile=/tmp/logsuperd
+logfile_maxbytes=0
+loglevel=error
 nodaemon=true
+user=root
 
-[program:init]
-command=/usr/local/bin/init.sh
-autostart=true
-
-[program:httpd-shib]
-command=httpd-shib-foreground
-stdout_logfile=/dev/fd/1
+[program:init-httpd-shib]
+command=/bin/bash -c "/usr/local/bin/init.sh && httpd-shib-foreground"
+stdout_logfile=/tmp/loghttpd
 stdout_logfile_maxbytes=0
 redirect_stderr=true
-autostart=true
 
 [program:midpoint]
 command=/bin/bash -c "java -Xmx2048M -Xms2048M -Dfile.encoding=UTF8 \
@@ -22,14 +21,21 @@ command=/bin/bash -c "java -Xmx2048M -Xms2048M -Dfile.encoding=UTF8 \
        -Dmidpoint.repository.hibernateHbm2ddl=none \
        -Dmidpoint.repository.missingSchemaAction=create \
        -Dmidpoint.repository.initializationFailTimeout=60000 \
-       -Dmidpoint.logging.console.enabled=true -Dmidpoint.logging.console.prefix='midpoint;midpoint.log;$ENV;$USERTOKEN;' -Dmidpoint.logging.console.timezone=UTC \
+       -Dmidpoint.logging.console.enabled=true -Dmidpoint.logging.console.prefix='midpoint;midpoint.log;${ENV};${USERTOKEN};' -Dmidpoint.logging.console.timezone=UTC \
        -Dspring.profiles.active=$ACTIVE_PROFILE \
        -Dauth.sso.header=$SSO_HEADER \
        -Dauth.logout.url=$LOGOUT_URL \
        -Dserver.tomcat.ajp.enabled=$AJP_ENABLED \
        -Dserver.tomcat.ajp.port=$AJP_PORT \
-       -jar $MP_DIR/lib/midpoint.war"
+       -jar $MP_DIR/lib/midpoint.war
+       -Dlogging.path=/tmp/logtomcat"
 stdout_logfile=/dev/fd/2
 stdout_logfile_maxbytes=0
 redirect_stderr=true
-autostart=true
+
+[program:tier-beacon]
+command=/usr/sbin/crond -i -m off
+stdout_logfile=/tmp/logcrond
+stdout_logfile_maxbytes=0
+redirect_stderr=true
+autorestart=false
diff --git a/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/library.sh b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/library.sh
index f574a66..a02ce3f 100755
--- a/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/library.sh
+++ b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/library.sh
@@ -5,9 +5,9 @@ linkSecrets(){
     	local label_file=`basename $filepath`
     	local file=$(echo $label_file| cut -d'_' -f 2)
 
-    	if [ $label_file = shib_* ]; then
+    	if [[ $label_file == shib_* ]]; then
             ln -sf /run/secrets/$label_file /etc/shibboleth/$file
-    	elif [ "$label_file" = "host-key.pem" ]; then
+    	elif [ "$label_file" == "host-key.pem" ]; then
             ln -sf /run/secrets/host-key.pem /etc/pki/tls/private/host-key.pem
     	fi
      done
@@ -15,7 +15,7 @@ linkSecrets(){
 
 
 checkMidpointSecurityProfile(){
-     if [ $ACTIVE_PROFILE = *'sso'* ]; then
+     if [[ $ACTIVE_PROFILE = *'sso'* ]]; then
 	cp /etc/httpd/possible-conf/midpoint-www-with-shibboleth-sso.conf /etc/httpd/conf.d/midpoint-www.conf
      else
         cp /etc/httpd/possible-conf/midpoint-www-without-shibboleth-sso.conf /etc/httpd/conf.d/midpoint-www.conf
diff --git a/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/sendtierbeacon.sh b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/sendtierbeacon.sh
new file mode 100644
index 0000000..31256ed
--- /dev/null
+++ b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/sendtierbeacon.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+
+LOGHOST="localhost"
+LOGPORT="80"
+
+if [ -s /opt/tier/env.bash ]; then
+  . /opt/tier/env.bash
+fi
+
+messagefile="/tmp/beaconmsg"
+
+if [ -z "$TIER_BEACON_OPT_OUT" ]; then
+    cat > $messagefile <<EOF
+{
+    "msgType"          : "TIERBEACON",
+    "msgName"          : "TIER",
+    "msgVersion"       : "1.0",
+    "tbProduct"        : "MIDPOINT",
+    "tbProductVersion" : "$MP_VERSION",
+    "tbTIERRelease"    : "$TIER_RELEASE",
+    "tbMaintainer"     : "$TIER_MAINTAINER"
+}
+EOF
+
+    curl -s -XPOST "${LOGHOST}:${LOGPORT}/" -H 'Content-Type: application/json' -T $messagefile 1>/dev/null 2>&1
+    if [ $? -eq 0 ]; then
+        echo "tier_beacon;none;$ENV;$USERTOKEN;"`date`"; TIER beacon sent"
+    else
+        echo "tier_beacon;none;$ENV;$USERTOKEN;"`date`"; Failed to send TIER beacon"
+    fi
+
+    rm -f $messagefile 1>/dev/null 2>&1
+
+fi
diff --git a/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/setenv.sh b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/setenv.sh
new file mode 100644
index 0000000..8006cfa
--- /dev/null
+++ b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/setenv.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+printenv | sed 's/^\(.*\)$/\1/g' | grep -E "^MP_VERSION" > /opt/tier/env.bash
+printenv | sed 's/^\(.*\)$/\1/g' | grep -E "^TIER_RELEASE" >> /opt/tier/env.bash
+printenv | sed 's/^\(.*\)$/\1/g' | grep -E "^TIER_MAINTAINER" >> /opt/tier/env.bash
diff --git a/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/setupcron.sh b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/setupcron.sh
new file mode 100644
index 0000000..50ac62c
--- /dev/null
+++ b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/setupcron.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+CRONFILE=/opt/tier/cronfile
+
+/opt/tier/setenv.sh
+
+echo "#send daily \"beacon\" to central" > ${CRONFILE}
+echo $(expr $RANDOM % 59) $(expr $RANDOM % 3) "* * * /usr/local/bin/sendtierbeacon.sh >> /tmp/logcrond 2>&1" >> ${CRONFILE}
+chmod 644 ${CRONFILE}
+crontab ${CRONFILE}
diff --git a/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/startup.sh b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/startup.sh
new file mode 100644
index 0000000..6a168ef
--- /dev/null
+++ b/grouper-midpoint/mp-gr/midpoint-server/container_files/usr-local-bin/startup.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# generic console logging pipe for anyone
+mkfifo -m 666 /tmp/logpipe
+cat <> /tmp/logpipe 1>&2 &
+
+mkfifo -m 666 /tmp/loghttpd
+(cat <> /tmp/loghttpd  | awk '{printf "%s\n", $0; fflush()}' 1>/tmp/logpipe) &
+
+mkfifo -m 666 /tmp/logshib
+(cat <> /tmp/logshib  | awk '{printf "%s\n", $0; fflush()}' 1>/tmp/logpipe) &
+
+mkfifo -m 666 /tmp/logcrond
+(cat <> /tmp/logcrond  | awk -v ENV="$ENV" -v USERTOKEN="$USERTOKEN" '{printf "crond;console;%s;%s;%s\n", ENV, USERTOKEN, $0; fflush()}' 1>/tmp/logpipe) &
+
+mkfifo -m 666 /tmp/logsuperd
+(cat <> /tmp/logsuperd | awk -v ENV="$ENV" -v USERTOKEN="$USERTOKEN" '{printf "supervisord;console;%s;%s;%s\n", ENV, USERTOKEN, $0; fflush()}' 1>/tmp/logpipe) &
+
+/usr/bin/supervisord -c /etc/supervisor/supervisord.conf