Identity federation - no longer optional