I've built something similar in a lab earlier this week. Microsoft really need to accelerate their development of External ID, what should be core functionality is either missing, not possible or in this case becomes a responsibility of the customer in many cases.