diff -ur ../arpfilter-orig/src/ch/SWITCH/aai/arpfilter/ArpFilter.java src/ch/SWITCH/aai/arpfilter/ArpFilter.java
--- ../arpfilter-orig/src/ch/SWITCH/aai/arpfilter/ArpFilter.java	2008-06-06 14:46:00.000000000 +0200
+++ src/ch/SWITCH/aai/arpfilter/ArpFilter.java	2008-07-31 14:21:14.000000000 +0200
@@ -110,10 +110,14 @@
   // method to continue to the arpviewer web application (leave IdP)
   private String post2ArpViewer(String reason, boolean editSettings,
       String returnURL, String username, String providerId,
-      Collection<Attribute> attributesReleased) throws
+      Collection<Attribute> attributesReleased,
+      HttpServletRequest request, LoginContext loginCtx) throws
       ArpException {
     LOG.info("continue2ArpViewer, reason: " + reason);
     LOG.debug("continue2ArpViewer: returnURL=" + returnURL);
+    LOG.debug("Saving LoginContext to HTTP Session for further use");
+    request.getSession().setAttribute(LoginContext.LOGIN_CONTEXT_KEY, loginCtx);
+    
     // action URL format:
     // https://host.domain.com/arpviewer/Controller/?returnUrl=https://idp.domain.com/Authn/RemoteUser&editsettings=true;
     String action = ArpConfiguration
@@ -229,6 +233,28 @@
         LOG.error("ArpFilter only work on HTTPRequests / responses");
         return;
       }
+      HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest;
+      if (!httpServletRequest.getServletPath().equalsIgnoreCase("/profile")) {
+          throw new ArpException("Please reconfigure filter for the profile servlet");
+      }
+      // search logincontext in httpsession
+      LoginContext loginCtx = (LoginContext) httpServletRequest
+          .getSession().getAttribute(LoginContext.LOGIN_CONTEXT_KEY);
+      if (loginCtx != null) {
+          //loginCtx put here by arpfilter, remove it now
+          LOG.debug("Returning from ArpViewer? Transferring LoginContext back to Request Scope");
+          httpServletRequest.setAttribute(LoginContext.LOGIN_CONTEXT_KEY, loginCtx);
+          httpServletRequest.getSession().removeAttribute(LoginContext.LOGIN_CONTEXT_KEY);
+      } else {
+        // search logincontext in request scope
+          loginCtx = (LoginContext) httpServletRequest
+              .getAttribute(LoginContext.LOGIN_CONTEXT_KEY);
+      }
+      if (loginCtx == null) {
+          LOG.debug("LoginContext not found, this must be the first visit to profile servlet");
+         filterChain.doFilter(servletRequest, servletResponse);
+         return;
+      }
 
       // initialize storage handler (stupid, but true)
       String storeType = ArpConfiguration
@@ -244,19 +270,13 @@
       // first try from IdP Session
       Session idpSession = (Session) ((HttpServletRequest) servletRequest).getAttribute(Session.HTTP_SESSION_BINDING_ATTRIBUTE);
       String username =  (idpSession != null) ? idpSession.getPrincipalName() : null;
-      // try it from remote user
-      if (username==null || username.equals(""))
-        username = ((HttpServletRequest) servletRequest).getRemoteUser();
       // not ok
-      if (username==null || username.equals(""))
-         throw new ArpException("No username found, assure authentication");
+      if (username==null || username.equals("")) {
+           throw new ArpException("No username found, assure authentication");
+      }
       LOG.debug("doFilter: username=" + username);
       
       // get the providerId from shib context
-      LoginContext loginCtx = (LoginContext) ((HttpServletRequest) servletRequest)
-          .getSession().getAttribute(LoginContext.LOGIN_CONTEXT_KEY);
-      if (loginCtx == null) 
-        throw new ArpException("No LoginContext found, may be back button pressed");
       String providerId = loginCtx.getRelyingPartyId();
       LOG.debug("doFilter: providerId=" + providerId);
       
@@ -306,14 +326,16 @@
       if (userInfo == null) {
         ((HttpServletResponse) servletResponse).getWriter().write(
             post2ArpViewer(CONTAV_REASON_FIRSTVISIT, editSettings, referer,
-                username, providerId, attributesReleased));
+                username, providerId, attributesReleased, 
+                httpServletRequest, loginCtx));
         return;
       }
       // check if the user wants to reset the settings
       if (editSettings) {
         ((HttpServletResponse) servletResponse).getWriter().write(
             post2ArpViewer(CONTAV_REASON_EDITAPPROVAL, editSettings, referer,
-                username, providerId, attributesReleased));
+                username, providerId, attributesReleased, 
+                httpServletRequest, loginCtx));
         return;
       }
 
@@ -328,7 +350,8 @@
             && !userTermsVersion.equalsIgnoreCase(termsVersion)) {
           ((HttpServletResponse) servletResponse).getWriter().write(
               post2ArpViewer(CONTAV_REASON_TERMSCHANGED, editSettings, referer,
-                  username, providerId, attributesReleased));
+                  username, providerId, attributesReleased, 
+                  httpServletRequest, loginCtx));
           return;
         }
       }
@@ -363,7 +386,8 @@
       if (providerId != null && !userInfo.containsProviderId(providerId)) {
         ((HttpServletResponse) servletResponse).getWriter().write(
             post2ArpViewer(CONTAV_REASON_NEWPROVIDER, editSettings, referer,
-                username, providerId, attributesReleased));
+                username, providerId, attributesReleased, 
+                httpServletRequest, loginCtx));
         return;
       }
 
@@ -376,7 +400,8 @@
           .getAttributesForProviderId(providerId), attributes)) {
         ((HttpServletResponse) servletResponse).getWriter().write(
             post2ArpViewer(CONTAV_REASON_ATTRCHANGED, editSettings, referer,
-                username, providerId, attributesReleased));
+                username, providerId, attributesReleased, 
+                httpServletRequest, loginCtx));
         return;
       }

