Impersonation details - New feature request

[Cantor, Scott]

On 10/9/17, 11:10 AM, "dev on behalf of O'Dowd, Josh" <dev-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:
> Is it the ability for an authorized subject to authenticate, where the resulting subject c14n represents an impersonated subject,
> fully audited, and under strict constraints?

No, because that's much riskier and more expansive than 99% of people would ever need.

What I did was build an interceptor that obtains a list of authorized account names and directs it to re-reresolve the attribute set based on a selected account name *for a single response* to a service.

The identity in the session never changes. It just passes out data for a different identity one request at a time, and you can plug in a function to return the list of authorized identities on a per-anything basis.

-- Scott