diff --git a/cadcAccessControl-Server/src/ca/nrc/cadc/ac/server/web/WhoAmIServlet.java b/cadcAccessControl-Server/src/ca/nrc/cadc/ac/server/web/WhoAmIServlet.java
index 6a11fdc6fa9d0622f34020ec63cedae4087c43de..8dff4ca5f73c62bc751ac66d5835eb49566ccfbd 100644
--- a/cadcAccessControl-Server/src/ca/nrc/cadc/ac/server/web/WhoAmIServlet.java
+++ b/cadcAccessControl-Server/src/ca/nrc/cadc/ac/server/web/WhoAmIServlet.java
@@ -169,10 +169,9 @@ public class WhoAmIServlet extends HttpServlet
 
         LocalAuthority localAuthority = new LocalAuthority();
         URI umsServiceURI = localAuthority.getServiceURI("ums");
-
         log.debug("ums service uri: " + umsServiceURI);
 
-        final URL serviceURL = registryClient.getServiceURL(umsServiceURI, Standards.UMS_USERS_01, AuthMethod.PASSWORD);
+        final URL serviceURL = registryClient.getServiceURL(umsServiceURI, Standards.UMS_USERS_01, AuthMethod.CERT);
         final URL redirectURL = new URL(serviceURL.toExternalForm() + USER_GET_PATH);
 
         // Take the first one.
diff --git a/cadcAccessControl/src/ca/nrc/cadc/ac/client/GMSClient.java b/cadcAccessControl/src/ca/nrc/cadc/ac/client/GMSClient.java
index e7f525b6896ce740f2d7b6bf87eec34b0b763e67..f8c72e7b342d44ccec2fa869c3a0098e782672a3 100755
--- a/cadcAccessControl/src/ca/nrc/cadc/ac/client/GMSClient.java
+++ b/cadcAccessControl/src/ca/nrc/cadc/ac/client/GMSClient.java
@@ -525,10 +525,10 @@ public class GMSClient implements TransferListener
                AccessControlException, IOException
     {
 
-        String path = targetGroupName + "/groupMembers/" + groupMemberName;
+        String path = "/" + targetGroupName + "/groupMembers/" + groupMemberName;
         URL groupsURL = getRegistryClient()
             .getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, AuthMethod.CERT);
-        URL addGroupMemberURL = new URL(groupsURL.toExternalForm() + "/" +  path);
+        URL addGroupMemberURL = new URL(groupsURL.toExternalForm() + path);
         log.debug("addGroupMember request to " + addGroupMemberURL.toString());
 
         // reset the state of the cache
@@ -586,10 +586,10 @@ public class GMSClient implements TransferListener
         log.debug("addUserMember: " + targetGroupName + " + " + userID.getName());
 
         String userIDType = AuthenticationUtil.getPrincipalType(userID);
-        String path = targetGroupName + "/userMembers/" + NetUtil.encode(userID.getName()) + "?idType=" + userIDType;
+        String path = "/" + targetGroupName + "/userMembers/" + NetUtil.encode(userID.getName()) + "?idType=" + userIDType;
         URL groupsURL = getRegistryClient()
             .getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, AuthMethod.CERT);
-        URL addUserMemberURL = new URL(groupsURL.toExternalForm() + "/" + path);
+        URL addUserMemberURL = new URL(groupsURL.toExternalForm() + path);
 
         log.debug("addUserMember request to " + addUserMemberURL.toString());
 
@@ -643,10 +643,10 @@ public class GMSClient implements TransferListener
         throws GroupNotFoundException, AccessControlException, IOException
     {
 
-        String path = targetGroupName + "/groupMembers/" + groupMemberName;
+        String path = "/" + targetGroupName + "/groupMembers/" + groupMemberName;
         URL groupsURL = getRegistryClient()
             .getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, AuthMethod.CERT);
-        URL removeGroupMemberURL = new URL(groupsURL.toExternalForm() + "/" + path);
+        URL removeGroupMemberURL = new URL(groupsURL.toExternalForm() + path);
         log.debug("removeGroupMember request to " +
                   removeGroupMemberURL.toString());
 
@@ -712,10 +712,10 @@ public class GMSClient implements TransferListener
         String userIDType = AuthenticationUtil.getPrincipalType(userID);
 
         log.debug("removeUserMember: " + targetGroupName + " - " + userID.getName() + " type: " + userIDType);
-        String path = targetGroupName + "/userMembers/" + NetUtil.encode(userID.getName()) + "?idType=" + userIDType;
+        String path = "/" + targetGroupName + "/userMembers/" + NetUtil.encode(userID.getName()) + "?idType=" + userIDType;
         URL groupsURL = getRegistryClient()
             .getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, AuthMethod.CERT);
-        URL removeUserMemberURL = new URL(groupsURL.toExternalForm() + "/" + path);
+        URL removeUserMemberURL = new URL(groupsURL.toExternalForm() + path);
 
         log.debug("removeUserMember: " + removeUserMemberURL.toString());
 
@@ -827,7 +827,7 @@ public class GMSClient implements TransferListener
 
         URL searchURL = getRegistryClient()
             .getServiceURL(this.serviceID, Standards.GMS_SEARCH_01, AuthMethod.CERT);
-        URL getMembershipsURL = new URL(searchURL.toExternalForm() + "/" + searchGroupPath.toString());
+        URL getMembershipsURL = new URL(searchURL.toExternalForm() + searchGroupPath.toString());
 
         log.debug("getMemberships request to " + getMembershipsURL.toString());
         ByteArrayOutputStream out = new ByteArrayOutputStream();
@@ -938,7 +938,7 @@ public class GMSClient implements TransferListener
 
         URL searchURL = getRegistryClient()
             .getServiceURL(this.serviceID, Standards.GMS_SEARCH_01, AuthMethod.CERT);
-        URL getMembershipURL = new URL(searchURL.toExternalForm() + "/" + searchGroupPath.toString());
+        URL getMembershipURL = new URL(searchURL.toExternalForm() + searchGroupPath.toString());
 
         log.debug("getMembership request to " + getMembershipURL.toString());
         ByteArrayOutputStream out = new ByteArrayOutputStream();
diff --git a/cadcAccessControl/src/ca/nrc/cadc/ac/client/UserClient.java b/cadcAccessControl/src/ca/nrc/cadc/ac/client/UserClient.java
index 248f9cbcd077023f6606532a4c8b5ca72812408f..5c46a1d8cbe06a78fd6df88ce9fc07ea927b381f 100644
--- a/cadcAccessControl/src/ca/nrc/cadc/ac/client/UserClient.java
+++ b/cadcAccessControl/src/ca/nrc/cadc/ac/client/UserClient.java
@@ -145,7 +145,7 @@ public class UserClient
     	{
 
 	        String userID = principal.getName();
-	        String path = NetUtil.encode(userID) + "?idType=" + this.getIdType(principal) + "&detail=identity";
+	        String path = "/" + NetUtil.encode(userID) + "?idType=" + this.getIdType(principal) + "&detail=identity";
 
 	        // augment subject calls are always https with client certs
             URL usersURL = getRegistryClient()
@@ -254,7 +254,7 @@ public class UserClient
         userWriter.write(user, userXML);
 
         URL createUserURL = getRegistryClient()
-            .getServiceURL(this.serviceID, Standards.UMS_REQS_01, AuthMethod.CERT);
+            .getServiceURL(this.serviceID, Standards.UMS_USERS_01, AuthMethod.CERT);
 
         if (createUserURL == null)
             throw new IllegalArgumentException("No service endpoint for uri " + Standards.UMS_REQS_01);