Impersonate and RemoteAccess

[Cantor, Scott]

On 5/20/21, 9:22 AM, "users on behalf of Marco Naimoli" <users-bounces at shibboleth.net on behalf of marco.naimoli at unipd.it> wrote:

>    itself. I'm sure it's not the only way to do this, and it's not the best way, but it's an easy way

If you're a member and you want to dive into the details in a support case so I can help analyze the risks, feel free, but I can't do that on list obviously, I'm just leaving it as a friendly warning that I really can't say what you're doing is clearly "safe" without more analysis.

I suspect one way to keep it "safer", and maybe this is what you did, is to prevent it from caching the RemoteUser result and make sure it re-runs each time so that a previous decision doesn't contaminate a later one. You don't do that with timeouts, though, that's done with a condition attached to the RemoteUser flow setting the caching of results to false, specifics vary by version. Pre 4.1 it's a field on the bean in general-authn.xml

-- Scott