> I originally wanted to protect the root web site, but the shib documentation > says not to leave the request mapper <path> specification empty or use "/". You protect the site by applying settings to <Host> -- Scott