IdPv3 deliberate change of principal and shared principals

[Scott Koranda]

Hi,

We are interested in enabling some users to deliberately switch their
principal after a successful authentication event. The general
idea is to support access to shared principals from existing
credentials.

We imagine that during a (modified) Password authentication
flow, after the user has authenticated and her "true" or
canonical principal has been identified, that principal could
be used to do a lookup and determine which if any of the
shared principals the user is allowed to exercise. If the list
of allowed shared principals is not empty, then the user would
be presented with a list and allowed to use which principal to
use. After selection the flow would continue but now with
attributes being resolved for the "new" principal so that the
assertion sent to the SP represents the shared principal.

If and how SSO would operate in this scenario is one of many
open questions.

I looked in the wiki but did not see any existing support for
this type of functionality. Have I missed it?

I also searched through the email archive but could not find
anything. If I have missed a thread on this subject please
kindly point me to it.

My first thought is that neither an intercept flow nor a
subject canonicalization flow would be able to implement this
type of functionality since it would most likely require
"removing" the canonical principal or preventing it from
really being "set" in the first place, and that a new
authentication flow evolved from Password would be required.

Thoughts?

We understand the argument that exercising shared access to a
service is probably best managed by the service or SP
supporting it, but alas, because IdPv3 is so flexible and has
empowered the IdP team to quickly solve problem after problem
for the organization, requests for ever more creative and
complex identity solutions keep coming directly to the IdP
team.

Thanks,

Scott K