Impersonation and resolutionPhases="intercept/impersonate"

[Cantor, Scott]

> I know the value for that is set to "intercept/impersonate"
> when resolving attributes to be relied on in the impersonate
> flow

There isn't anything done of that sort, not by the IdP anyway. The attribute resolution that happens is exactly this:

> but will it also be set to that same value if the user chooses
> someone to impersonate, and attributes need to be "re
>-resolved" for that new userid? 

That's what it's doing, and it is meant to be setting the resolution label (which is what the ill-named "phase" term is talking about) to that when it does.

When no impersonation happens, it just leaves the existing resolved attributes alone.

In most cases, it's rarely necessary to base anything on that label because the "standard" resolution done for a subject is exactly what's needed if the identity switches. The whole point was to make it pretty non-eventful and risk-free to deploy once you have the access controls in place. If you had to do lots of resolver surgery, it would be counterproductive.

-- Scott