it is now possible for the owner of a client to apply client specific scoping if the module is configured to use the saml:SP authsource