[security-dev] Federated JDO more than an IDM API?