It appears that the ACS has IDP-style features within the "Service Identities" section. How does the ACS treat these in comparison to a real IDP? What is missing?
Some examples I'm thinking of include: Account Lockout, Auditing, Token Replay, etc. These come more into light when comparing the credentials to a "real" IDP such as CA SiteMinder, ADFS 2.0, and Ping
Given the contrasting examples, what is ACS + Service Identities missing?
What features matter?
What is the resulting intended (or non intended use) AS-IS today?