Sep 19, 2008 at 8:29 PM
I am looking at the RequestSecurityTokenResponse.cs, GetTokenAttributes ( ) method.

There is one comment: "Remove the PPID claim if it exists; we need to call the PPID provider instead". 

What and how is PPID used for in STS? What do your comment mean?

Sep 19, 2008 at 9:20 PM
The PPID isn't used for anything, it's simply for fufilling a PPID claim if you support it.

The only provider there right now is one that reflects the suggested PPID from the RST back again, but this may not be what you need, as it depends on the cardID rather than an internal identifier from your membership database, hence the ability to swap it out if you need to.