TAS3 specifies some approaches for doing this, see [TAS3D41ID], mainly based on using advanced authorization to obtain discovery token without authenticating the User. Liberty Advanced Client approach, see [AdvClient] and [SOAPAuthn2], SHOULD be used.