The affiliation-based rule you have there is invalid, since "nobody" is not a valid value for eduPersonAffiliation. In addition, and more to the point of your question, you can't have access control rules statically defined for content that's passively protected. You won't be able to access them without a session and you'd get a 403. -- Scott