Where to hook in switching of user identity

[Christopher Bongaarts]

On 6/22/2016 7:28 PM, Cantor, Scott wrote:
> If you do it as a c14n flow, that would flip the session to the target user and pretty much everything would just run as though that user logged in. But you're also talking about manipulating authentication methods...this is really low level stuff. It's not designed to do this.

In our case, the intention is that SSO would operate as the target user, 
with the target authentication method.  For comparison, our current 
implementation (custom login handler in v2) creates our (proprietary) 
SSO session cookie (self- encrypted user identifier, validation type, 
timestamp) using the details of the target user/validation type.

Being able to include the original user and/or auth method as additional 
session data would be a nice-to-have but is out of scope for the initial 
implementation unless it comes "for free".

> The most conservative approach is with a login flow modified to do all this. The contract out of that is explicit and clean and the rest of the system will run the way it's meant to based on whatever comes out of that.

Thanks, this is something I can probably do.  Is there a particular spot 
in the stock (LDAP) password login flow that would be a good place to 
switch out the user?  Perhaps in authn-flow, inserting an Action between 
the calls to the auth subflow and the c14n subflow?

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%