Path access control

[Young, Darren]

I have the following section in the Shibboleth2.xml, when I access /secure
I am authenticated and granted access. When I go to /secure/AllStaff I am
a member of the specified group and gain access however when I go to
/secure/FullTimeOnly I am also granted access even though I¹m not in the
specified group.

Restarted shib_default on the machine, same behavior and there are no
errors in the logs. Have also tried each child path both as /secure/X and
as just X. As in "/secure/AllStaff" or just ³AllStaff².

<RequestMapper type="Native">
  <RequestMap>
    <!--
    The example requires a session for documents in /secure on the
containing host with http and
    https on the default ports. Note that the name and port in the <Host>
elements MUST match
    Apache's ServerName and Port directives or the IIS Site name in the
<ISAPI> element above.     -->
    <Host name="wwwprod.chicagobooth.edu²>

                
      <!-- Our default /secure area, any valid ID can see -->
      <Path name="secure" authType="shibboleth" requireSession="true"/>

        <!-- /secure/AllStaff only Staff has access -->
        <Path name=³/secure/AllStaff" authType="shibboleth"
requireSession="true">
          <AccessControl>
            <Rule 
require="ucisMemberOf">uc:org:Booth:AffiliationGroups:Staff</Rule>
          </AccessControl>
        </Path>

        <!-- /secure/ITOnly only IT people have access -->
        <Path name=³/secure/ITOnly" authType="shibboleth"
requireSession="true">
          <AccessControl>
            <Rule 
require="ucisMemberOf">uc:org:Booth:AffiliationGroups:IT_Services</Rule>
          </AccessControl>
        </Path>

                   
        <!-- /secure/Systems only the Systems group has access -->
        <Path name=³/secure/Systems" authType="shibboleth"
requireSession="true">
          <AccessControl>
            <Rule 
require="ucisMemberOf">uc:org:Booth:admgroups:Systems</Rule>
          </AccessControl>
         </Path>
                
          
        <!-- /secure/FullTimeOnly only the Systems group has access -->
        <Path name=³/secure/FullTimeOnly" authType="shibboleth"
requireSession="true">
          <AccessControl>
            <Rule 
require="ucisMemberOf">uc:org:Booth:AffiliationGroups:MBA_Campus</Rule>
          </AccessControl>
         </Path>
    </Host>
  </RequestMap>
    </RequestMapper>



Any help would be appreciated.

Thanks