Repository navigation
Impersonation: end impersonation and return to the original session #53982
dialvarezs
started this conversation in
Ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Description
When an admin impersonates a user from the Admin Console in the same realm, Keycloak replaces the admin's browser session with the impersonated user's session (the console warns that the current session will be logged out). There is no way to end the impersonation and get back to the admin's own session: the only option is to log out and log in again with the admin's credentials.
I'd like to propose an optional "end impersonation" flow: when impersonation starts, Keycloak keeps a reference to the impersonator's session, and offers an endpoint (and a link / indicator in the Account Console) that terminates the impersonated session and restores the original one.
Motivation
Support staff impersonate users to see an application exactly as they see it, check a permission issue, and then go back to their own work. Today every round trip costs a full re-login, and since the impersonator's session is gone, it is easy to lose track of which identity the browser is using.
Other identity products already support this:
impersonate_without_logout, with a banner and a button to go back to the admin session.All reactions