Apache 2.4

[Cantor, Scott]

Actually, I can spot one necessary compatibility change right away. The new authz API will require rules based on arbitrary attribute IDs to be reformed as "require shib-attr attributeId ..." because you can't register to handle an unbounded or unknown set of require rule names.

So "require affiliation student" will have to become "require shib-attr affiliation student".

I'd have to add that option in for <V2.4 as a migration aid.

-- Scott