    <Location />
        AuthType shibboleth
        ShibRequestSetting applicationId sp2
        ShibRequestSetting requireSession 1
        # Erweitern Sie hier die Autorisierungsregel...
        Require valid-user
    </Location>

    <Location /testapp>
        AuthType shibboleth
        ShibRequestSetting applicationId sp2
        ShibRequestSetting requireSession 1
        # ... und schränken Sie hier dafür den Zugriff ein:
        <RequireAll>
            Require shib-attr affiliation staff@local employee@local faculty@local
            Require shib-attr entitlement https://sp2.local/entitlement/politologie
        </RequireAll>
    </Location>
    
    ProxyPass /Shibboleth.sso/* !
    ProxyPass "/testapp" "ajp://localhost:8009/testapp"
    ProxyPassReverse "/testapp" "ajp://localhost:8009/testapp"