> Is this IDP-1623? Almost surely a variant on it. Thanks a lot for the reference and to Matthew for catching it first. I'll likely do the uid resolution and canonicalization a la the recipe in the Wiki separately from the gathering of attributes from the upstream IdP. Thanks for taking the time to answer, Nate.