That context (if it exists, which is not necessarily true) is underneath the AuthenticationContext, and the input is normally the PRC. It's PRC -> AuthenticationContext- > RequestedPrincipalContext. If there are no requirements, it won't be there. -- Scott