What is identity assertion anyway?
In same cases, it is necessary for a server to act on behalf of its clients. This is typical in the case where a client calls a mid-tier server, and the server further needs to call an end-tier server as part of the service requested by the client. In other words, it is necessary to let the end-tier server know that while it (the mid-tier server) is making the invocation, access control decision must be based on the original caller’s privileges.