Bypassing CAS/SSO middlewares

Trying to elegantly bypass a CAS middleware, by not running the auth check in the middleware based on the existence of the impersonated_by session variable. We can get the user id from that, and verify the user exists, but I want to establish they have a valid session as well as checking the cas token against the imposter. but the imposter can have multiple sessions in the DB - so we don't know which session it is. (if expired or not) is there anyway (other than more middleware) to replace the impersonated_by with the the session id instead of the user id (or just add the session id)