> I found that Apache's HttpClient within the IdP does not just throw an > Authorization header at the server. It waits for the server to respond > with 401 Unauthorized, No, it's possible in both versions to do it unsolicited, but it required a lot of hacks in V4, it was streamlined in V5. It's documented in both cases. -- Scott