"403 Forbidden" error

[Cantor, Scott]

>   require shib-user ~ .*@andrew.cmu.edu$

There seems little doubt that that's the rule that isn't being satisfied, so whatever you're getting or mapping into REMOTE_USER probably doesn't match, if it's anything at all.

Add showAttributeValues="true" to the <Handler> in the configuration at /Session, and then access /Shibboleth.sso/Session after logging in, and you'll see what the data is. And you'll know what REMOTE_USER would have been based on what you chose to map into it.

-- Scott