Generally if the 404 is from Tomcat, not Apache, then you haven't excluded /Shibboleth.sso from the AJP proxy rule. Otherwise it's an Apache access rule problem. -- Scott