I know this question has sort of been asked in the past but it was a long time ago so just wanted to see if that was still the case?
You can do this but the version of Authentication Services needs to be 4.1.0-21630 or higher for this to work as expected. It also requires a configuration setting in the vas.conf.
This article here should cover the details.
In reply to Leigh Grant:
In reply to jon.scobie: