Shadow Account – An account required by a Service Provider application and mapped to one or more federated identities. A shadow account may be an LDAP/Active Directory account, contained in database tables or application specific user stores. A shadow account is not used for end user initial authentication.
