0

I have read the issues about impersonation, and from what i could find so far it can be achieved. I'm not sure tho if the following could be done using it.

A user doesn't have permission to do a certain operation, but it can be done if a supervisor grant him access.

The grant would be only for that operation/request.

is this something that can be done using impersonation, or there is a better approach for this?

Thanks in advance.

Felipe Loest
  • 1
  • 1

1 Answers1

2

Quick brain dump of what you could do: You would have to implement this yourself in the user service in IdentityServer. One approach is to pass a custom param in the acr_values from the client with the ID of the user you want to impersonate (you will also have to pass prompt=login to force the request to go to the login workflow and thus the user service). In your user service implementation in PreAuthenticate you can check if the user is already authenticated, the custom acr_values is present, and the user is allowed to impersonate the user being requested. You'd then assign the AuthenticateResult on the context with the identity of the new user. This short circuits the login process and will return back to the authorization endpoint, and then back to your client app.

Brock Allen
  • 7,385
  • 19
  • 24