Identity Provider (auth origin)
role:
idpS0 · capability probe
- detecting…
origin check
- server sees
https://lramalho.net- browser sees
…
S3 · session & freshness
not signed in
The username is entered here (first-party) and becomes the personId.
Tenants receive both the real identity and the pairwise
H(personId, tenantId) — showing either is possible to transport.