In the Shibboleth IdP it's possible to enable the impersonation intercept to enable help desk to impersonate users.
The impersonation is an amazing feature very well designed.
You can enable it in three steps:
- enable the module;
- add a p:postAuthenticationFlows="#{ {'impersonate'} }" attr to the SAML2 property to the relying party list involved (relying-party.xml);
- configure it on conf/access-control.xml (legacy configuration file in conf/intercept is useless).
The documentation proposes a workflow where a help desk operator has to be authorized to impersonate johndoe user by adding the johndoe value to a certain operator's attribute.
If your requirements allow any help desk operator to impersonate any user, the configuration can be simply:
The impersonation event is logged on the IdP. But if you want to let the SP to know about it, you can leverage the "populate the impersonated principal name into the attached SubjectContext" phase of the module. What you need is a acript that picks the added Subject and turns it to an attribute:
Add it to attribute-resolver.xml:
Of course the attribute format can be embedded in the declaration or be pulled in from a property file in conf/attributes/custom:
