Some folks here in Athens are talking about on-demand-provisioning hooks in shib (eg for calling a scim-api backend). How hard would it be to add a hook in the shib sp to allow the incoming attributes to be serialized (CBOR of course :-)) to an external call which could drive provisioning before the response is handed back to the application? Cheers Leif