Where to hook in switching of user identity

[Christopher Bongaarts]

Continuing down my checklist of v2 stuff to implement in v3:  we have a 
feature in our login handler that, when activated for a particular 
instance of IdP, allows a user (who is a member of a particular group 
for authorization) to impersonate other users. The user ("spoofer") 
enters their own credentials (username/password), and the identifier of 
the user they want to impersonate ("target"), as well as the 
authentication method they want to simulate.  The IdP then creates a 
session with the target user as the principal and the simulated auth 
method as the auth type.  Thus, the SP sees the user as having 
authenticated as the target user, with the target auth method, and 
receives attributes for the target user.

I was able to implement the authorization check without too much hassle, 
by cloning the Context Check intercept.

Now I want to implement the user switching aspect, and I'm looking for 
guidance on how to integrate it.  In particular, I'm wondering if this 
function should logically be part of the authentication process (perhaps 
as a post-auth or output intercept), or part of the subject canonization 
process.

I think I understand what I need to do to accomplish this (replacing the 
SubjectContext for the spoofer with the target), so it's more a question 
of where.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%