There are many forms of impersonation:
- Sudo in *nix
- Application impersonation (
send asin Exchange)
- Any privileged user (helpdesk) logging in as a user so to not disclose the password
- RunAs Administrator in Windows
I'm looking for an authentication system, that itself, defines a sequence of steps to:
- Log all valid impersonation attempts
- Ensures the display those attempts to the account owner
- The account owner either passively accepts, or marks them as suspicious.
In a sense this could be codified as an RFC, similar to how spam UCE is reported, or DMARC reporting.
My goal is to port this logic into a proprietary authentication system, keep the logging format the same, and if possible, track and update the disposition of each attempt.
I'm not trying to rework the wheel here, and think some prior work should exist.