Impersonation plugin

This plugin allows certain users to assume the identity of another user. A privileged user first logs in with its real account and can then choose another profile to appear as. This feature can be especially useful for training/learning or development platforms.

Attention

This plugin should not be used on production instance, prefer ContextSwitching plugin.

Configuration

Just enable it in the Manager (section “plugins”) by setting a rule. Impersonation can be allowed or denied for specific users. Furthermore, specific identities like administrators or anonymous users can be protected from being impersonated.

  • Parameters:

    • Use rule: Rule to allow/deny users to impersonate or define which users may use this plugin.

    • Identities use rule: Rule to define which identities can be assumed. Useful to prevent impersonation of certain sensitive identities like CEO, administrators or anonymous/protected users

    • Unrestricted users rule: Rule to define which users can assume ALL users. Identities use rule is bypassed.

    • Hidden attributes: Attributes not displayed

    • Skip empty values: Do not use empty profile attributes

    • Merge spoofed and real SSO groups: Can be useful for administrators to keep higher privileges. “Special rule” field can be used to set SSO groups to merge if exist in real session. Multivalue separator is used. By example : su; admins; anonymous

Danger

You HAVE TO modify REMOTE_USER to log both real AND spoofed uid.

Set a macro like this :

_whatToTrace -> $real__user ? "$real__user/$_user" : "$_user/$_user"

and set General Parameters > Logs > REMOTE_USER with _whatToTrace

Attention

Both spoofed and real session attributes can be used to set access rules, groups or macros.

By example : $real_uid && $real_uid eq 'dwho' or $real_groups && $real_groups =~ /\bsu\b/

Keep in mind that real session is computed first. Afterward, if access is granted, impersonated session is computed with real and spoofed session attributes if Impersonation is allowed. So, real_ attributes are computed by second authentication process. To avoid Perl warnings, you have to prefix regex with $real_var &&.

Attention

By example, to prevent impersonation as ‘dwho’ set Identities use rule like :

$uid ne 'dwho'

impersonationPrefix is used to rename user’s real profile attributes. You can set real attributes prefix (‘real_’ by default) by editing lemonldap-ng.ini in section [portal]:

[portal]
impersonationPrefix = real_