Impersonation in IDP

[Cantor, Scott]

> We have a need to implement impersonation is IDP. We are using MFA flow
> and the primary authentication is RemoteUser. I’m wondering if it is possible
> to switch user identity in mfa-authn-config.xml

It would be a major feature requiring extreme care and quite a bit of internal knowledge. There is no casual response I could give you, I haven't thought about what it would take.

A Shibboleth SP can already do this easily, so in the event that that's the use case, I would simply tell whoever it is to do it there.

-- Scott