> Which reminds me of something I need to bottom out, but will observe - in > the SP validity monitoring is done at the provider level. AFAIR in the IdP it is > an explicit filter invoked after resolution. Is it? I didn't think so. It has to be checking at runtime same as the SP since entries go from valid to invalid in the background. -- Scott