> AllowCreate [Optional]
>
> "Note that this does not prevent the identity
> provider from creating such identifiers outside the context
> of this specific request (for example, in advance for a large
> number of principals)."
This is, AFAIC, the relevant passage. This meant quite simply that nothing
in the spec was intended to force people to use per-SP identifiers on the
fly or otherwise.
My point is that the SP's opinion about AllowCreate is irrelevant. The IdP
is the one judging whether the action it's going to take is permissible if
that attribute is false.
-- Scott
