Users authenticated by a web app other than the IdP?