Where to hook in switching of user identity

[Eric Goodman]

>While I completely agree with you on this, I haven’t run across many SaaS vendors who support this sort of functionality [impersonation].

Understood. Again, for our approach we have a SAML proxy between the IdPs and the actual S/I/PaaS vendor and are putting the impersonation in that proxy. We colloquially call the proxy an "IdP Proxy", but I really think of it more as an SP proxy. 

So the flow with impersonation would be:

SP [request] -> SAML Proxy [forwards] -> IdP [authenticates user] -> SAML Proxy [allows impersonation] -> SP [consumes assertion]

The SP isn't technically aware of the impersonation in any real sense. That said, from a practical standpoint I expect that if we do this the SAML proxy will release a separate attribute for logging purposes). E.g., the final assertion would contain "ePPN" and "originallyAuthenticatedUserEPPN". 

--- Eric



-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Walter Forbes Hoehn (wassa)
Sent: Friday, June 24, 2016 11:19 AM
To: Shib Users
Subject: Re: Where to hook in switching of user identity


-WFH


> On Jun 24, 2016, at 11:45 AM, Eric Goodman <Eric.Goodman at ucop.edu> wrote:
> 
> * I see impersonation as something that's more an SP function than an IdP function, so I like NOT having the impersonation implemented in the IdP.
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net