Comment by mc32

One hopes the Oktas of the world had this figured out and this is more a problem when you host your own IDP.