[PROPOSAL] Separate Public Identifier from IdP Identifier

[Chris Drake]

CHRIS DRAKE'S PROPOSED FLOW

1) User *enters* UPI, but a Discovery Agent intercepts this: UPI does
   *not* get posted to RP
2) Discovery Agent sends UPI to IdP
3) IdP authenticates against UPI
4) IdP selects appropriate RP-specific IPI
5) IdP initiates authentication with RP using IPI


Kind Regards,
Chris Drake,
=1id.com