Implementing a local SSO hook into v3

[Christopher Bongaarts]

Since we are planning to allow our v2 and v3 IdPs to interoperate over a 
couple of months (yes, I know it's not the recommended upgrade path), 
and we also want a way for our account initiation/claiming/creation 
processes to not require the user to retype a password they just typed a 
moment ago, we're planning to implement our shared-encrypted-cookie 
mechanism for SSO in v3. This is functionally identical to the 
browser-cookie storage used in v3 for session data - relevant session 
data (user identifier, auth type, timestamp) are encoded and encrypted 
using a symmetric algorithm (e.g. AES) whose key is shared with the 
services allowed to assert SSO.

Is there a good place to insert the:
- reading of a cookie and converting it to an AuthenticationResult to be 
interpreted for SSO
- writing a cookie out to reflect a just-completed authentication

Perhaps on either ends of a custom authn flow?  Actions would have 
access to the http request/response objects so could presumably read/set 
cookies.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%