Support for step-up authentication

The switch user administrator can switch to another user who has stepped up to a higher authentication level.

To complete this switch, provide additional arguments to the switch user module in the following format:

su_authn_method = module& arg1 arg2 .... argx

You can use the –l option followed by the level number to designate step-up authentication levels. For example:

su-password = /opt/pdwebrte/lib/libsuformauthn.so& -l 1
su-certificate = /opt/pdwebrte/lib/libsucert.so& -l 3
su-token-card = /opt/pdwebrte/lib/libsucustom.so& -l 2

The administrator can use this feature to specify one level per authentication method. If the administrator needs to step up further while switched to the other user, the administrator must know the user's login information for the specific authentication method.