I figured it out! I had a block that looked like this:
<Location ~ (/wp-admin|/wp-login.php)>
Require ip 1.2.3.4/16
Require ip 5.6.7.8/16
</Location>
This meant that Require shibboleth
from the <Location />
block was being overridden. The solution:
<Location ~ (/wp-admin|/wp-login.php)>
<RequireAll>
Require shibboleth
<RequireAny>
Require ip 1.2.3.4/16
Require ip 5.6.7.8/16
</RequireAny>
</RequireAll>
</Location>
Thanks for your prompt support!