Allow user impersonation to quickly try out other roles

[sschuberth]

Before inviting new user or changing roles of a user, you want to be very sure to not accidentally grant to wide permissions. To double-check the planned roles to give, an "impersonation" feature would be great that allows to temporarily play "what if" by giving one's own user different roles to see the effect of the role change.

[Etsija]

When implementing #1031 I noticed that as they are, the permissions are already "too wide": giving a user READERS rights to an organization allows the user to see all products under the org., and all repositories in all these products. Same goes for WRITERS and ADMINS rights: all access rights cascade down the entity tree, see my issue #1056, item 3.

[mnonnenmacher]

Keycloak has an impersonation feature: https://www.keycloak.org/docs/latest/server_admin/index.html#con-user-impersonation_server_administration_guide
I haven't tried it, but maybe this can be used without any code changes in the server.

[sschuberth]

Keycloak has an impersonation feature

It seems to be available in version 23.0.0 already, so that's good.

[mnonnenmacher]

@sschuberth Did you check if this works for you or if this issue is still required?

[sschuberth]

No, I didn't check. In any case, I'd expect support for this to be implemented in the ORT Server UI directly, probably from the menu for the profile icon.

[mnonnenmacher]

There is an endpoint for impersonation:
https://www.keycloak.org/docs-api/latest/rest-api/index.html#_post_adminrealmsrealmusersuser_idimpersonation

But I could not find documentation for how to end the impersonation and switch back to the original user.