Impersonation in IDP

[Cantor, Scott]

> Here is the answer from our Adoble Sign admin regarding why user want to
> logon to Adobe Sign using shared account(departmental account):

I had assumed you meant Adobe Creative Cloud, I'm not familiar with that service.

I don't actually know how you got it to produce the error you did, which seems very unusual to me, but that's sort of the point.

This feature is something a lot of people want, and also something a lot of people are (rightly) terrified of, and there are a number of different places it could be injected. It has complex implications for SSO, for one thing.

I would strongly advise against anybody trying to do this inside a login flow. I'm pretty convinced it doesn't belong there and the complexity would be off the charts. I suspect it's really an interceptor that applies policy and then drops the attribute set and resolves a new one after the determination is made to switch the identity. That would confine it to a single transaction at a time and avoid polluting the SSO and session layer with really difficult questions.

-- Scott