I have a service that's updating objects in the appDb using the platform web service. The update results in an approval. Is their any means to associate the ACTING user with the request rather than the logon user?

kerberos is designed to allow a web service to impersonate a user. So if you use kerberos to authenticate people accessing your service then you should be able to make a request to the FIM web service as that user.David Lundell www.ilmBestPractices.com