> Can anyone suggest how it is determining a user without engaging the > authentication handler? In that log, it is engaging the handler. The IdP has no control over whether REMOTE_USER is set, obviously. -- Scott