Intended identity switch

[Rainer Hoerbe]

Hi Michael,

We have the same use case and share the requirement that users should not be asked to re-authenticate to change their organizational context or role. What we want from a user perspective is a dialogue that will ask on logout to choose between  logout and role/context change.

Our (so far purely theoretical) plan would be 
1. establish a fallback IDP-session in a browser cookie
2. perform global logout for a role change (the user is actually logged out at IDPs and SPs if successful)
3. modify the logout notification page to offer a role change. The fallback IDP session needs a pointer the user in the user database. The user can then choose to logout, thus destroying the copied session. Or to login again with the new role/context. Instead of re-authenticating a previous session would be faked using the fallback session.

If that would work it would be better then the current implementation, which is a bit crude: If the user changes the role, a redirect to the role selection page at the IDP will result in an unsolicited assertion for just the single SP - good for power users, confusing for everybody else.

- Rainer

> Am 23.08.2016 um 22:57 schrieb Prog <programmierstudi at gmx.de>:
> 
> Dear people,
> 
> recently the idea came up, that people who have accounts at different organizations of our IdM could possibly switch identity (principals) without performing logout/login manually. I can't imagine how that would work without performing global logout from all sessions involved, but it might well be that i just have never heard (read about) alternatives. However, assuming the global logout succeeds the idea is to use REMOTE_USER authentication (or x509 or something) behind the scenes (server to server) and then delegate the new session back to the client somehow. ECP might help us to initiate the new session. I've read about delegating sessions from client to application (uportal...more?) but not the other way around. Are these mechanism suitable or are there better ones? Do additional mechanisms exist to fill in the gaps? How could we delegate the new session to the users client?
> 
> Please note that we use IdP2 in that case with NIIF slo and have a working global logout setup, so a possible flow can involve redirecting the client to global logout in the first step. We possibly could also switch to IdP3 if that is a better option (already on the roadmap but we still are working on optimization of our IdP3 setup). I know that changes to our IdM might raise the proposed mechanism obsolete and in fact we are reworking the IdM but this is still in the early days.
> 
> Thanks you for reading.
> 
> All the best,
> 
> Michael
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net