This message was deleted.

this is not supported in the way you described due to security concerns and best-practices

@steep-lamp-91158 Thanks for responding. What you mean by "authenticate the user properly"?

the user who would get the impersonation session needs to authenticate somehow as well, but using their own credentials only after you know that they actually are who they claim to be, you should allow them to "impersonate" someone when you create a session using the admin API, you run the risk of not properly authenticating the user

That all sounds like a Hydra thing, right?

depends, but that's something you have to keep in mind when building impersonation and why we don't support it natively

@steep-lamp-91158 Can you provide a little more detail?

In your app at some point you determine the current user, with Kratos by taking the user ID from the whoami response. There you can add a way to use a different user ID instead:

func getCurrentUserID(req *http.Request) (string, err) {
  user, err := getWhoAmI(req)

  if impersonated := req.Headers.Get("Impersonated-User-Id"); impersonated != "" {
    if isAllowedToImpersonate(user, impersonated) {
      return impersonated, nil
    }
  }
  return user.id, nil
}

For reusability, it would obviously be best to do this in a gateway, depending on your setup.

Oh, I see what you mean. So build some kind of mechanism that adds the header or a cookie, etc.. And then use something like your code at a central place.