<SPConfig...
  <RequestMapper type="Native">
    <RequestMap>
      <Host name="confluence.its.umu.se">
        <Path name="confluence">
          <AccessControl>
            <OR>
              <!-- Allow non-authenticated sessions (Confluence protects all of /confluence/ using Shibboleth) -->
              <NOT>
                <Rule require="valid-user" />
              </NOT>
              <!-- Allow SWAMID AL2 sessions from IdP:ns without SWAMID -->
              <AND>
                <Rule require="assurance">http://www.swamid.se/policy/assurance/al2</Rule>
                <Rule require="Meta-Assurance-Certification">http://www.swamid.se/policy/assurance/al2</Rule>
                <Rule require="Meta-registrationAuthority">http://www.swamid.se/</Rule>
              </AND>
               <!-- Allow REFEDS RAF medium sessions from IdP:s outside of SWAMID -->
              <AND> <AND>
                <Rule require="assurance">https://refeds.org/assurance/IAP/medium</Rule>
                <Rule require="assurance">https://refeds.org/assurance/ID/eppn-unique-no-reassign</Rule>
                <NOT>
                  <Rule require="Meta-registrationAuthority">http://www.swamid.se/</Rule>
                </NOT>
              </AND>
            </OR>
          </AccessControl>
        </Path>
      </Host>
    </RequestMap>
  </RequestMapper>
  <ApplicationDefaults...
    <Sessions...
    <Errors ...
      access="accessError.html"
    />
  ...
  </ApplicationDefaults
  ...
</SPConfig>