Shib Gurus, Just a suggestion (and perhaps you already addressed this) but one thing to keep in mind for your design for multi-factor authn flows is that the solution should be stateless i.e. an IDP may see step 1, but not step 2. Otherwise, it complicates the load balancer algorithm (requires sticky sessions...) - Mike