Where to hook in switching of user identity

[Cantor, Scott]

> In our case, the intention is that SSO would operate as the target user,
> with the target authentication method.  For comparison, our current
> implementation (custom login handler in v2) creates our (proprietary)
> SSO session cookie (self- encrypted user identifier, validation type,
> timestamp) using the details of the target user/validation type.

The user-switching step is something you could do in c14n, but it's not really designed to go messing around with the *type* of authentication (the custom principal set, basically).

> Being able to include the original user and/or auth method as additional
> session data would be a nice-to-have but is out of scope for the initial
> implementation unless it comes "for free".

An advantage of doing it in the login flow is that you could write code to supplement the Subject with custom Principal objects (of your design) carrying some of that information if you wanted it.

> Thanks, this is something I can probably do.  Is there a particular spot
> in the stock (LDAP) password login flow that would be a good place to
> switch out the user?  Perhaps in authn-flow, inserting an Action between
> the calls to the auth subflow and the c14n subflow?

That's an option. Modifying the individual login flows is what I was thinking, but if you wanted to do it in the master flow that's probably possible.

Bear in mind that in 3.3 the convention is that the login flows actually do the c14n step, so I'm still shifting things around. When you mess with the authn flow itself, that's a system detail that we're free to change. Creating your own login flow OTOH is more likely to be stable long term.

-- Scott