> When password is expired the $username attribute on login.vm is null. If it's not set, it's not there, there's nothing much the IdP can do about it, it just pulls it from the place it was stored off the last time through. As far as I'm aware it's generally set regardless of the actual error condition that's signaled. -- Scott