Geek Answers Handbook

Spring security (3.0.x) and user impersonation

There are times in my web application when an authenticated administrator may want to impersonate another valid user of the system without knowing this user password.

How can I use Spring Security to give administrators the ability to impersonate regular users (not administrators) of the system?

There is nothing in the Spring Security documentation, and I cannot find anything. Of course, someone must have decided this.

Thanks!

+8
java spring spring-security impersonation
source share
3 answers

In Spring Security 3 and Spring Security 4, the docs are precisely named, "Run as a replacement for authenticity."

The AbstractSecurityInterceptor function can temporarily replace the authentication object in the SecurityContext and SecurityContextHolder during the callback phase of the protected object.

+5
source share

I find the recommended way to do this in Spring. Security is domain access control lists, see GrantedAuthoritySid @

http://static.springsource.org/spring-security/site/docs/3.1.x/reference/domain-acls.html

However, impersonating another user is more than just having a “delegate id”, you should also consider the consequences of registering:

  • You want your logging to display as "Original User" or "Advanced User" (or both?).
  • Do you want the "impersonation" to show only what the user-personal user sees, or a subset of the permissions of the Original user and the personified user?

Another possibility is to create a "log in" function, which will significantly change the main identifier of the current session - or start a new session with the personified identifier.

In all of the above, you can inadvertently open up a security problem - which is why I believe that this is why functions with a personalized style are not the usual place. Rather, it is developing a trend towards role-based access control (RBAC) or attribute-based access control (ABAC). Using RBAC / ABAC, you can create a delegate style function where you create delegate attributes / roles, and in special cases when you need to show the source / purpose of delegation (for example, for audit logs), you treat them as corner cases.

+3
source share

If you want an admin user to impersonate another user (e.g. for QA / Testing), look at SwitchUserFilter

A nice example of the required XML configuration here

0
source share

More articles:


All Articles