BFF impersonation feature

[riaadh]

hello, does the BBF implement the impersonation , to connect with an admin account and choose to hava a token for another account?
If not, do you plan to implement it ?
Since we have a paid subscription, my company is willing to pay for this feature.

thank you

[wcabus]

Duende's BFF framework merely acts as a proxy or gateway to securely host SPA's and Blazor applications. User impersonation is a functionality that typically has no "one size fits all" solution, because:

• a user may need to provide credentials or a second factor before being able to impersonate
• only specific users may be allowed to impersonate
• where would the impersonation take place? On the identity provider level, or does it also rewrite the BFF's session cookie to store the impersonated session?

Implementing impersonation on the BFF level may be as easy as adding a custom access token retriever on specific routes, or involve customizing several management endpoints to allow an existing session to be upgraded to an impersonation session.

On the identity provider side, impersonation could be achieved by implementing a token exchange extension grant, but could also require adapting some of the authentication steps to allow users to switch impersonation contexts.

We do have a sample demonstrating how to use the token exchange grant to impersonate a user in a BFF host for a specific API request. However, we can't assist you in adopting this sample to fit your needs.
We can introduce you to one of our partners if you require consultancy assistance, please contact us with a reference to this GitHub discussion if you want us to make an introduction.