> Now that I know where it is coming from and why, are there any constraints I can put in place at the IdP to reject these requests, > or should I make those restrictions at the web server? Web server. -- Scott