startingpoint from SecurityTokenService