Intended identity switch

[Cantor, Scott]

On 8/23/16 4:57 PM, Prog wrote:
> 
> recently the idea came up, that people who have accounts at different
> organizations of our IdM could possibly switch identity (principals)
> without performing logout/login manually. I can't imagine how that would
> work without performing global logout from all sessions involved, but it
> might well be that i just have never heard (read about) alternatives.

Well, it's certainly not implemented, but one of the V3 changes was to
isolate the session layer from the authentication layer from the
"identifying the subject in a request" layer. Everything is discrete,
and the handoffs are just implemented in particular ways.

It's not impossible in the abstract to change the system to transform
the subject "as authenticated" into some other subject for the purposes
of a request.

It *could* be implemented actually as an interceptor. The interceptor
would have some work to do to cleanup the previous subject state to get
things in place for the rest of the process to flow, but it could be done.

So...it's not impossible to plug it in out of the box now, basically.

> However, assuming the global logout succeeds the idea is to use
> REMOTE_USER authentication (or x509 or something) behind the scenes
> (server to server) and then delegate the new session back to the client
> somehow. ECP might help us to initiate the new session. I've read about
> delegating sessions from client to application (uportal...more?) but not
> the other way around. Are these mechanism suitable or are there better
> ones? Do additional mechanisms exist to fill in the gaps? How could we
> delegate the new session to the users client?

I....literally have no idea what you're talking about, but it sounds
terrifying, wrong, insecure, and just an all around bad idea.

> Please note that we use IdP2 in that case with NIIF slo and have a
> working global logout setup, so a possible flow can involve redirecting
> the client to global logout in the first step.

If you're going to logout, then why even think of this as an identity
switch at all? You're just changing from one session as user A to
another as user B.

V3 already supports automatic user switching. If you change identities,
the old session with the client is dumped and replaced by a new one. And
there's certainly no logout involved.

-- Scott