Impersonation

Configure user impersonation for support.

Overview

Impersonation allows administrators to:

• View system as another user
• Troubleshoot issues
• Provide support

Who Can Impersonate

Impersonation is a permission, not a setting: it requires the IMPERSONATE_USERS node ("Impersonate Any User") on the role you are acting as. SUPER_ADMIN holds it.

• Nobody can impersonate themselves.
• A non-superuser cannot impersonate a user with higher privileges (a superuser).
• An impersonation ends automatically after two hours.

Starting Impersonation

1. Open the person's or student's record
2. Click Impersonate
3. Confirm impersonation
4. Session logged

During Impersonation

• Banner indicates impersonation active
• You see exactly what the impersonated user's acting role sees, and the API allows only what that role allows
• Every change is recorded against you, with the impersonated person recorded beside you on the audit row
• Role network rules use your address, not theirs. Impersonating a registrar from a network where the Registrar role is not permitted gives no registrar access; see Role Networks
• Email cannot be sent. Compose Email refuses while impersonating, because the mail would leave under the other person's name and address
• Your session's idle timeout is yours: the impersonated role's idle limit is not applied

Ending Impersonation

1. Click End Impersonation
2. Return to normal session
3. Session logged

An impersonation belongs to the login that started it

Migration 248 bound each impersonation to its originating login session via auth_session_hash. Ending that login ends the impersonation with it — an impersonation cannot outlive the session it began in, and cannot be resumed from a different login.

The sweep that closes stale impersonations is age-scoped, so it retires abandoned ones without disturbing live sessions.

Stopping always works

Ending an impersonation stays available whatever your acting role, and even when no role is usable from your network, so nobody can be stranded inside one.

Audit Trail

All impersonation logged:

• Who impersonated
• Target user
• Start/end times
• Actions taken