AC-143 new api end point to impersonate user #85
Conversation
nlgordon
left a comment
nlgordon
left a comment
There was a problem hiding this comment.
I'm struggling to see how this is limited to just root admins. What stops a normal user from accessing the new impersonateUser endpoint?
I need to still push the changes. |
|
| sessionkey = attrObj.toString(); | ||
| } | ||
| } | ||
| response.setCookie(String.format("JSESSIONID=%s;account=%s;domainid=%s;role=%s;sessionkey=%s;timezone=%s;timezoneoffset=%s;userfullname=%s;userid=%s;username=%s", |
There was a problem hiding this comment.
This isn't actually enough to make the UI update all the various user fields. So when the the user goes to the UI they still have the name of the admin that was doing the impersonation.
There was a problem hiding this comment.
Yeah, I agree. In order to reflect this change in the complete web UI page then there are some UI files need to be updated with the session cookie values. But I was asked to do only API session related changes. If UI changes are required I can do that. what is your recommendation on that?
ggoodrich-ipp
added
final review
Description
This is a new Api endpoint that allows us to impersonate a user in the system. This endpoint should only be callable by an ‘admin’ and should return the same cookies that the Cloud Infrastructure UI returns,
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?