Implement impersonation/delegation behavior

Confirm you’ve already contributed to this project or that you sponsor it

• I confirm I’m a sponsor or a contributor

Version

3.x

Question

I was inspired by this comment (I’m still not sure if I need to ask this question there) when was starting to implement something. If I understood correctly, I need to implement a call to token endpoint with specific grant type and custom request parameter.

The main question I have: how to trigger that request, should I do that using http client or initialize a challenge or somehow else? if I do that using http client, how can I preserve related principal? If I can’t pass principal with the request, then how should I validate the request? I believe, this is something a quite simple, but I can’t grope the answer.

[a-a-k]

Uhh! Brilliant, I see that there is no cookie in the request to MVC controller and I know why. Digging into this to fix…

[jwillmer]

@kevinchalet I’m looking at a similar use case and have one question regarding your example in this task:

You propose to add a new parameter to the authentication cookie if the parameter value was defined/transferred by the request. That means each app that supports the impersonation of a user has to implement a check if this parameter exists and then use this information to display the (impersonated) username / validate that this user in fact can execute the requested action?

context.ProtocolMessage.SetParameter("impersonated_username", username);