Hi Daniel, yes, I totally agree with you here. AppliesTo is an important bit of the WS-T spec and the STS supports it, so there is no reason at all for this to be missing in the client side. As a matter of fact, AppliesTo is a lot more important than specifying the token type, as it identifies the target endpoint and this allows the STS to perform very important work, like encrypting proof keys using the target's public key - something not possible when the target endpoint is unknown. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4257220#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...