> Java property file/s for the (hashed) secrets sounded > sufficient initially, until I remembered that you can't reload > those (reliably) in the running IDP. You could use the htpasswd file support in the IdP since the client authentication feature supports all the password validators. That is reloadable, though not well tested. -- Scott