If you're using Apache, you should consider using the native ShibRequestSetting commandcommand, as it's generally safer and more natural to use. If you want to use the XML syntax instead, be sure to turn on the UseCanonicalName Apache option to avoid leaving security holes.