Hello, The default for IdPv3 for direct NameID mapping as recorded in subject-c14n.xml in the shibboleth.NameTransformPredicate is an empty whitelist--no relying parties by default can complete an attribute query with a direct NameID mapping. I am curious why that is the default? Thanks, Scott K