The terminal gets the permissions of the user running the terminal. If ran as root it auths using PAM and if successful it does setuid().

When sharing users pass around URLS (with an UUID) for that terminal, with the permissions of the user that started it.

David.

As this looks like advertishment to me, I will post about my own UNIX web terminal emulator. Its C, executable only 100kb for the executable with everything contained, and many of the goodies from GateOne (multiple sessions, session attached to user, not browser window...) It also even has colaborative terminal, where two users can attach to the same terminal. All AGPLv3. https://github.com/davidmoreno/onion/tree/master/examples/oterm

There are several projects that do something similar, for example oterm (https://github.com/davidmoreno/onion/wiki/Oterm. Disclaimer: its my project). This one just need 80kb of a executable, everything included. We have used it succesfully on some released products, as the Aisoy1 Robot, although is disabled by default. There are other, mostly written in python, but my google-fu is not working today. Also FireSSH was there before. On gate one the only new thing is that you dont get access to a computer but to a ssh session. Next time I know that whenever I do something remotely new (although I know there are similar things) I have to post to slashdot.