> It probably is covered. Assuming Chris accurately understood the goal, no, the standard certainly doesn't cover that. Making it the private business of an authentication mechanism at the IdP is one way of doing something like that. -- Scott