> > I hope they're under no illusions that that's a secure way to operate. > > To clarify - they perform maintenance/security updates as required. But they > only allow SP metadata & configuration updates during quarterly windows Metadata *is* security in a SAML system using inline keys. -- Scott