To support SSO and other use cases, we have to be able to look up identities based on any combination of:

• User name (possibly derived from authentication principal)
• Authentication principal (possibly derived from evidence)
• Evidence

Realms are not required to support more than just user name-based lookup, however for SSO support a realm will have to be able to look up and verify token Evidence in one step.