> I know of the context-check interceptor flow, but it looks like you'd > essentially have to configure a flow to block the user that's used by default > and have one just for the service provider in question to allow access. Yes, but that's what you're asking how to do. -- Scott