Where to hook in switching of user identity

[Eric Goodman]

>> See my response to Walter: there's nothing to stop you from releasing both the "real" subject ID 
>>and the "impersonated" one to the SP, so it seems like delivered logging should be fine.

>To do that, the SP has to be reconfigured to not do any scope-checking on scoped 
>attributes asserted by the IdP Proxy. In other words, the SP must be reconfigured 
>to explicitly support impersonation. In that case, it's fair to say that the SP and IdP 
>Proxy share the same security domain.

This is a good point. I overlooked that because (a) our primary purpose for the proxy is to "fix" feature-poor SPs (so not Shib) and scope checking isn't implemented in many of those and (b) the use case where we are considering impersonation relies on attributes that are not scoped in the SAML sense anyway -- ID validation relies on a different mechanism -- so it's not a direct issue there either.

So for our immediate use case this isn't a problem, but if we want to look at generalizing the approach we'll have to think about this more carefully.

Thanks!

--- Eric