Rename a static property variable and make a coulple methods protected access so exensions of the class can access the methods.
diff --git a/stack/rest/src/main/java/org/apache/usergrid/rest/management/ManagementResource.java b/stack/rest/src/main/java/org/apache/usergrid/rest/management/ManagementResource.java
index 285a22e..737d187 100644
--- a/stack/rest/src/main/java/org/apache/usergrid/rest/management/ManagementResource.java
+++ b/stack/rest/src/main/java/org/apache/usergrid/rest/management/ManagementResource.java
@@ -60,7 +60,7 @@
 import static javax.servlet.http.HttpServletResponse.*;
 import static javax.ws.rs.core.MediaType.*;
 import static org.apache.commons.lang.StringUtils.isNotBlank;
-import static org.apache.usergrid.security.tokens.cassandra.TokenServiceImpl.USERGRID_EXTERNAL_PROVIDER_URL;
+import static org.apache.usergrid.security.tokens.cassandra.TokenServiceImpl.USERGRID_EXTERNAL_SSO_PROVIDER_URL;
 import static org.apache.usergrid.security.tokens.cassandra.TokenServiceImpl.USERGRID_EXTERNAL_SSO_ENABLED;
 import static org.apache.usergrid.utils.JsonUtils.mapToJsonString;
 import static org.apache.usergrid.utils.StringUtils.stringOrSubstringAfterFirst;
@@ -385,7 +385,7 @@
                 OAuthResponse response =
                     OAuthResponse.errorResponse( SC_BAD_REQUEST ).setError( OAuthError.TokenResponse.INVALID_GRANT )
                         .setErrorDescription( "SSO Integration is enabled, Admin users must login via provider: "+
-                            properties.getProperty(TokenServiceImpl.USERGRID_EXTERNAL_PROVIDER) ).buildJSONMessage();
+                            properties.getProperty(TokenServiceImpl.USERGRID_EXTERNAL_SSO_PROVIDER) ).buildJSONMessage();
                 return Response.status( response.getResponseStatus() ).type( jsonMediaType( callback ) )
                     .entity( wrapWithCallback( response.getBody(), callback ) ).build();
 
@@ -620,7 +620,7 @@
             if ( !userServiceAdmin(username)) {
                 // this guy is not the superuser
                 throw new IllegalArgumentException( "Admin Users must login via " +
-                        properties.getProperty( USERGRID_EXTERNAL_PROVIDER_URL ) );
+                        properties.getProperty(USERGRID_EXTERNAL_SSO_PROVIDER_URL) );
             }
         }
     }
diff --git a/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UserResource.java b/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UserResource.java
index c66822c..21d4c23 100644
--- a/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UserResource.java
+++ b/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UserResource.java
@@ -46,7 +46,7 @@
 import java.util.UUID;
 
 import static org.apache.usergrid.security.shiro.utils.SubjectUtils.isServiceAdmin;
-import static org.apache.usergrid.security.tokens.cassandra.TokenServiceImpl.USERGRID_EXTERNAL_PROVIDER_URL;
+import static org.apache.usergrid.security.tokens.cassandra.TokenServiceImpl.USERGRID_EXTERNAL_SSO_PROVIDER_URL;
 import static org.apache.usergrid.utils.ConversionUtils.string;
 
 
@@ -138,7 +138,7 @@
 
         if ( tokens.isExternalSSOProviderEnabled() ) {
             throw new IllegalArgumentException( "Admin Users must reset passwords via " +
-                properties.getProperty( USERGRID_EXTERNAL_PROVIDER_URL ) );
+                properties.getProperty(USERGRID_EXTERNAL_SSO_PROVIDER_URL) );
         }
 
         if ( json == null ) {
@@ -224,7 +224,7 @@
 
         if ( tokens.isExternalSSOProviderEnabled() ) {
             throw new IllegalArgumentException( "Admin Users must reset passwords via " +
-                    properties.getProperty( USERGRID_EXTERNAL_PROVIDER_URL ) );
+                    properties.getProperty(USERGRID_EXTERNAL_SSO_PROVIDER_URL) );
         }
 
         UUID organizationId = null;
@@ -268,7 +268,7 @@
 
         if ( tokens.isExternalSSOProviderEnabled() ) {
             throw new IllegalArgumentException( "Admin Users must reset passwords via " +
-                    properties.getProperty( USERGRID_EXTERNAL_PROVIDER_URL ) );
+                    properties.getProperty(USERGRID_EXTERNAL_SSO_PROVIDER_URL) );
         }
 
         UUID organizationId = null;
@@ -354,7 +354,7 @@
 
         if ( tokens.isExternalSSOProviderEnabled() ) {
             throw new IllegalArgumentException( "Admin Users must activate via " +
-                    properties.getProperty( USERGRID_EXTERNAL_PROVIDER_URL ) );
+                    properties.getProperty(USERGRID_EXTERNAL_SSO_PROVIDER_URL) );
         }
 
         UUID organizationId = null;
@@ -384,7 +384,7 @@
 
         if ( tokens.isExternalSSOProviderEnabled() ) {
             throw new IllegalArgumentException( "Admin Users must confirm via " +
-                    properties.getProperty( USERGRID_EXTERNAL_PROVIDER_URL ) );
+                    properties.getProperty(USERGRID_EXTERNAL_SSO_PROVIDER_URL) );
         }
 
         UUID organizationId = null;
@@ -420,7 +420,7 @@
 
         if ( tokens.isExternalSSOProviderEnabled() ) {
             throw new IllegalArgumentException( "Admin Users must reactivate via " +
-                    properties.getProperty( USERGRID_EXTERNAL_PROVIDER_URL ) );
+                    properties.getProperty(USERGRID_EXTERNAL_SSO_PROVIDER_URL) );
         }
 
         logger.info( "Send activation email for user: {}" , user.getUuid() );
@@ -444,7 +444,7 @@
 
         if ( tokens.isExternalSSOProviderEnabled() ) {
             throw new IllegalArgumentException( "Admin Users must tokens must be revoked via " +
-                properties.getProperty( USERGRID_EXTERNAL_PROVIDER_URL ) );
+                properties.getProperty(USERGRID_EXTERNAL_SSO_PROVIDER_URL) );
         }
 
         UUID adminId = user.getUuid();
@@ -481,7 +481,7 @@
 
         if ( tokens.isExternalSSOProviderEnabled() ) {
             throw new IllegalArgumentException( "Admin Users must tokens must be revoked via " +
-                properties.getProperty( USERGRID_EXTERNAL_PROVIDER_URL ) );
+                properties.getProperty(USERGRID_EXTERNAL_SSO_PROVIDER_URL) );
         }
 
         UUID adminId = user.getUuid();
diff --git a/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UsersResource.java b/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UsersResource.java
index 828b46a..ca7833b 100644
--- a/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UsersResource.java
+++ b/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UsersResource.java
@@ -44,7 +44,7 @@
 
 import static org.apache.commons.lang.StringUtils.isBlank;
 import static org.apache.usergrid.rest.exceptions.SecurityException.mappableSecurityException;
-import static org.apache.usergrid.security.tokens.cassandra.TokenServiceImpl.USERGRID_EXTERNAL_PROVIDER_URL;
+import static org.apache.usergrid.security.tokens.cassandra.TokenServiceImpl.USERGRID_EXTERNAL_SSO_PROVIDER_URL;
 
 
 @Component( "org.apache.usergrid.rest.management.users.UsersResource" )
@@ -116,7 +116,7 @@
 
         if ( tokens.isExternalSSOProviderEnabled() ) {
             throw new IllegalArgumentException( "Admin Users must signup via " +
-                    properties.getProperty( USERGRID_EXTERNAL_PROVIDER_URL ) );
+                    properties.getProperty(USERGRID_EXTERNAL_SSO_PROVIDER_URL) );
         }
 
         // email is only required parameter
diff --git a/stack/rest/src/test/java/org/apache/usergrid/rest/management/ExternalSSOEnabledIT.java b/stack/rest/src/test/java/org/apache/usergrid/rest/management/ExternalSSOEnabledIT.java
index 75fa0b5..972ed05 100644
--- a/stack/rest/src/test/java/org/apache/usergrid/rest/management/ExternalSSOEnabledIT.java
+++ b/stack/rest/src/test/java/org/apache/usergrid/rest/management/ExternalSSOEnabledIT.java
@@ -166,7 +166,7 @@
 
         // /managment/token -> adminusername and password --> should fail.
         ApiResponse postResponse1 = pathResource("management/token").post(false, ApiResponse.class,loginInfo1);
-//        fail( "SSO Integration is enabled, Admin users must login via provider: "+ USERGRID_EXTERNAL_PROVIDER_URL);
+//        fail( "SSO Integration is enabled, Admin users must login via provider: "+ USERGRID_EXTERNAL_SSO_PROVIDER_URL);
 
 
 
diff --git a/stack/rest/src/test/java/org/apache/usergrid/rest/management/ManagementResourceIT.java b/stack/rest/src/test/java/org/apache/usergrid/rest/management/ManagementResourceIT.java
index 21c62ba..b689527 100644
--- a/stack/rest/src/test/java/org/apache/usergrid/rest/management/ManagementResourceIT.java
+++ b/stack/rest/src/test/java/org/apache/usergrid/rest/management/ManagementResourceIT.java
@@ -37,7 +37,7 @@
 import java.io.IOException;
 import java.util.*;
 
-import static org.apache.usergrid.security.tokens.cassandra.TokenServiceImpl.USERGRID_EXTERNAL_PROVIDER_URL;
+import static org.apache.usergrid.security.tokens.cassandra.TokenServiceImpl.USERGRID_EXTERNAL_SSO_PROVIDER_URL;
 import static org.apache.usergrid.security.tokens.cassandra.TokenServiceImpl.USERGRID_EXTERNAL_SSO_ENABLED;
 import static org.apache.usergrid.utils.MapUtils.hashMap;
 import static org.junit.Assert.*;
@@ -633,7 +633,7 @@
 
         String suToken = clientSetup.getSuperuserToken().getAccessToken();
         Map<String, String> props = new HashMap<String, String>();
-        props.put( USERGRID_EXTERNAL_PROVIDER_URL, getBaseURI().toURL().toExternalForm() );
+        props.put(USERGRID_EXTERNAL_SSO_PROVIDER_URL, getBaseURI().toURL().toExternalForm() );
         pathResource( "testproperties" ).post( props );
 
 
@@ -653,7 +653,7 @@
 
         // unset the Usergrid Central SSO URL so it does not interfere with other tests
 
-        props.put( USERGRID_EXTERNAL_PROVIDER_URL, "" );
+        props.put(USERGRID_EXTERNAL_SSO_PROVIDER_URL, "" );
         pathResource( "testproperties" ).post( props );
     }
 
@@ -673,7 +673,7 @@
         String suToken = clientSetup.getSuperuserToken().getAccessToken();
         Map<String, String> props = new HashMap<String, String>();
         props.put(USERGRID_EXTERNAL_SSO_ENABLED, "true");
-        props.put( USERGRID_EXTERNAL_PROVIDER_URL, getBaseURI().toURL().toExternalForm() );
+        props.put(USERGRID_EXTERNAL_SSO_PROVIDER_URL, getBaseURI().toURL().toExternalForm() );
         pathResource( "testproperties" ).post( props );
 
         try {
@@ -687,7 +687,7 @@
                     put( "grant_type", "password" );
                 }};
                 ApiResponse postResponse = pathResource( "management/token" ).post( false, ApiResponse.class, loginInfo );
-                fail( "SSO Integration is enabled, Admin users must login via provider: "+ USERGRID_EXTERNAL_PROVIDER_URL);
+                fail( "SSO Integration is enabled, Admin users must login via provider: "+ USERGRID_EXTERNAL_SSO_PROVIDER_URL);
 
             } catch (ClientErrorException actual) {
                 assertEquals( 400, actual.getResponse().getStatus() );
@@ -734,7 +734,7 @@
 
             // turn off validate external tokens by un-setting the usergrid.central.url
 
-            props.put( USERGRID_EXTERNAL_PROVIDER_URL, "" );
+            props.put(USERGRID_EXTERNAL_SSO_PROVIDER_URL, "" );
             props.put(USERGRID_EXTERNAL_SSO_ENABLED, "");
             pathResource( "testproperties" ).post( props );
         }
diff --git a/stack/services/src/main/java/org/apache/usergrid/management/cassandra/ManagementServiceImpl.java b/stack/services/src/main/java/org/apache/usergrid/management/cassandra/ManagementServiceImpl.java
index 97febdf..746d9dd 100644
--- a/stack/services/src/main/java/org/apache/usergrid/management/cassandra/ManagementServiceImpl.java
+++ b/stack/services/src/main/java/org/apache/usergrid/management/cassandra/ManagementServiceImpl.java
@@ -967,7 +967,7 @@
     }
 
 
-    private boolean validateAdminInfo( String username, String name, String email, String password ) throws Exception {
+    protected boolean validateAdminInfo( String username, String name, String email, String password ) throws Exception {
         if ( email == null ) {
             return false;
         }
@@ -988,7 +988,7 @@
     }
 
 
-    private UserInfo createAdminUserInternal( UUID organizationId, String username, String name, String email, String password,
+    protected UserInfo createAdminUserInternal( UUID organizationId, String username, String name, String email, String password,
                                               boolean activated, boolean disabled, Map<String, Object> userProperties )
             throws Exception {
         logger.info( "createAdminUserInternal: {}", username );
diff --git a/stack/services/src/main/java/org/apache/usergrid/security/sso/SSOProviderFactory.java b/stack/services/src/main/java/org/apache/usergrid/security/sso/SSOProviderFactory.java
index 2b9755e..31e085e 100644
--- a/stack/services/src/main/java/org/apache/usergrid/security/sso/SSOProviderFactory.java
+++ b/stack/services/src/main/java/org/apache/usergrid/security/sso/SSOProviderFactory.java
@@ -41,7 +41,7 @@
 
     public ExternalSSOProvider getProvider(){
 
-        return getSpecificProvider(properties.getProperty(TokenServiceImpl.USERGRID_EXTERNAL_PROVIDER));
+        return getSpecificProvider(properties.getProperty(TokenServiceImpl.USERGRID_EXTERNAL_SSO_PROVIDER));
 
     }
 
diff --git a/stack/services/src/main/java/org/apache/usergrid/security/tokens/cassandra/TokenServiceImpl.java b/stack/services/src/main/java/org/apache/usergrid/security/tokens/cassandra/TokenServiceImpl.java
index 46ea7fe..4815f9d 100644
--- a/stack/services/src/main/java/org/apache/usergrid/security/tokens/cassandra/TokenServiceImpl.java
+++ b/stack/services/src/main/java/org/apache/usergrid/security/tokens/cassandra/TokenServiceImpl.java
@@ -776,9 +776,10 @@
 
     //SSO2 implementation
     public static final String USERGRID_EXTERNAL_SSO_ENABLED = "usergrid.external.sso.enabled";
-    public static final String USERGRID_EXTERNAL_PROVIDER =    "usergrid.external.sso.provider";
-    public static final String USERGRID_EXTERNAL_PROVIDER_URL = "usergrid.external.sso.url";
-
+    public static final String USERGRID_EXTERNAL_SSO_PROVIDER =    "usergrid.external.sso.provider";
+    public static final String USERGRID_EXTERNAL_SSO_PROVIDER_URL = "usergrid.external.sso.url";
+    public static final String USERGRID_EXTERNAL_SSO_PROVIDER_USER_PROVISION_URL
+        = "usergrid.external.sso.userprovision.url";
 
 
     private static Client jerseyClient = null;
@@ -802,7 +803,7 @@
     }
 
     private String getExternalSSOProvider(){
-            return properties.getProperty(USERGRID_EXTERNAL_PROVIDER);
+            return properties.getProperty(USERGRID_EXTERNAL_SSO_PROVIDER);
     }
 
     /**