Impersonate a User

applies to versions 8 2 9+ and 8 3 4+ overview impersonation in activate allows authorised users to temporarily assume the identity of another user within the system this is useful for support and administrative teams to troubleshoot issues, verify permissions, or replicate user experiences testing new functionality from the perspective of different user roles unlike previous versions, impersonation is not enabled by default for administrators all users, including administrators, must be explicitly granted impersonation access through role based configuration recommendations use impersonation primarily in pre production environments for testing in production, use it sparingly and only for debugging specific issues grant access on a limited basis , scoped to the issue being investigated remove impersonation access once the issue is resolved to maintain security and compliance understanding roles impersonation requires two distinct system roles 1\ impersonators role identifies users who can impersonate others users in this role can initiate impersonation sessions (if all configurations are complete) examples support team, administrators, qa testers configuration create or use an existing role called impersonators assign relevant users to this role configure the availableimpersonateusers parameter to reference the impersonate target role 2\ impersonate target role defines which users can be impersonated only users assigned to this role can be selected as impersonation targets examples business users, power users, or any user whose experience needs to be replicated configuration create a new role (e g , impersonate target ) add users who can be impersonated to this role reference this role in the availableimpersonateusers parameter within the impersonators role referencing broad roles such as system roles/users for uat or qa environments is possible but not recommended due to excessive access step by step configuration 1\ assign users to the impersonators role navigate to system roles > impersonators if the role does not exist, create it assign all users who require impersonation access to this role 2\ define who can be impersonated in the impersonators role, configure availableimpersonateusers parameter of type reference or role reference this parameter must reference a role containing impersonation targets example create a new role system roles > impersonate target add the target users to this role set availableimpersonateusers = impersonate target ➡️ this parameter is mandatory—no default access is provided 3\ enable impersonation system wide go to resources > configuration > web set by default, this setting is disabled on all new installs and updates auditing all impersonation activity is logged for auditing purposes jobs submitted during impersonation include a log entry indicating impersonation users must provide a reason when submitting jobs as an impersonated user this reason is recorded all impersonation activity is recorded in web log the log file rotates when it reaches 100mb