Now, that you, as the user, let the RP in (please see my previous posting) based on RP’s certificate and logos, RP, in turns, could express its security token requirements to you before it grants you some access. Consider the following xml fragments...