IdPv3 deliberate change of principal and shared principals

[Paul Hethmon]

On Mar 22, 2016, at 12:20 PM, Scott Koranda <skoranda at gmail.com> wrote:
> 
> My first thought is that neither an intercept flow nor a
> subject canonicalization flow would be able to implement this
> type of functionality since it would most likely require
> "removing" the canonical principal or preventing it from
> really being "set" in the first place, and that a new
> authentication flow evolved from Password would be required.
> 
> Thoughts?

Scott,

I did exactly this within v2 by modifying my login handler. In that model, the handler knows the user has other identities they are allowed to assume and then uses the chosen identity to report to Shibboleth for attribute resolution.

So not applicable to v3, but its a great feature in our space (real estate) as it lets the user assume the “team” identity for a lot of applications they don’t have an internal concept of multiple identities.

cheers,

Paul


-----
Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com