Activation command uses current logged in user or the system user in case of workflow to authenticate against
the subscriber. this works in standalone systems where magnolia is a master application and you have logged in to it, problem arrises
once you move to SSO environment where magnolia may or may not be the master and do not have access to the user credentials.

IMO:

• if workflow is active, we should use the credentials of the user who is proceeding the workitem (participant), or the defined user in
  workflow definition
• In case of direct activation, use system user and impersonate as the logged in user