> Shibboleth IDP is exposing these servlet url as part of REMOTE_USER > authentication. It does nothing of the kind, those servlets are implementation details of a login mechanism internal to the IdP, they are not in any sense part of the public interface of the software. -- Scott