I'm wondering if the acr's might be better as URI's in the openid.net domain? Maybe something like "https://openid.net/connect/acrs/phr" Wouldn't it make the origin of these acr's a little more clear, and reduce the risk of collision? - Mike ------------------------------------- Michael Schwartz Gluu http://gluu.org