Shibboleth SP 2.6 and Apache 2.2 config

[Cantor, Scott]

> What I'm unsure about are the " ShibRequestSetting requireSession 1" and
> "require shib-session"  in the proposed new conf [2] doing the same thing.
> Do I need both or only one of them?

The former tells the SP to establish a session if the URL is accessed without one, the latter is an Apache authorization rule that blocks access if no session exists.

-- Scott