Skip to content

Add impersonate User feature #7988

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 15 commits into from
Closed

Add impersonate User feature #7988

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
5922fca
Add i18n templates.
mpmadhavig Apr 1, 2025
7211d85
Add util function to generate pkce challange and verifier.
mpmadhavig Apr 1, 2025
f118356
Modifiy danger zone components to add a non danger component.
mpmadhavig Apr 1, 2025
97a138a
Add impersonate user button and functionality.
mpmadhavig Apr 1, 2025
cfe669e
Add license header.
mpmadhavig Apr 1, 2025
c0fe3f7
Make my account impersonate role uneditable.
mpmadhavig Apr 1, 2025
1b85128
Separate out impersonation action.
mpmadhavig Apr 28, 2025
2b3572f
Remove impersonate role edit priviledges.
mpmadhavig Apr 28, 2025
82d4ff5
Address PR comments.
mpmadhavig Apr 28, 2025
d329c55
Show only Applications section when myaccount impersonation.
mpmadhavig Apr 28, 2025
15c7784
Refactor.
mpmadhavig Apr 28, 2025
adfbf2b
Add timeout for impersonation completion.
mpmadhavig May 4, 2025
05fd85e
Fix webappconfig issue.
mpmadhavig May 4, 2025
10796e4
Refactor.
mpmadhavig May 4, 2025
29c0973
Add init-impersonate.html in the myaccount callback.
mpmadhavig May 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 46 additions & 0 deletions apps/console/src/public/resources/iframe.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
<!--
~ Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com). All Rights Reserved.
~
~ This software is the property of WSO2 LLC. and its suppliers, if any.
~ Dissemination of any information or reproduction of any material contained
~ herein in any form is strictly forbidden, unless permitted by WSO2 expressly.
~ You may not alter or remove any copyright or other notice from copies of this content."
-->

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Impersonate Iframe</title>
</head>
<body onload="authenticate()">
<script>
var hash = window.location.hash;
const params = new URLSearchParams(window.location.search);
const userId = params.get("userId");
const code_challenge = params.get("codeChallenge");
const client_id = "Pfao0gjJ07be0gf29PzEcLFKmUIa";
const authorization_endpoint = sessionStorage.getItem("authorization_endpoint");

function authenticate() {

const requestUrl = authorization_endpoint
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are loading the spa-sdk from console/index.html. So this iframe too may have access to that. If it does, we can use the spa sdk methods to build the authorization URL, instead of chaining params manually

+ "?client_id=" + client_id +
"&redirect_uri=" + window.location.origin + window.location.pathname +
"&state=sample_state&scope=internal_user_impersonate&response_type=id_token%20subject_token" +
"&requested_subject=" + userId +
"&nonce=2131236&code_challenge=" + code_challenge + "&code_challenge_method=S256";
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's randomize the nonce value

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PS: If you are using spa sdk, we wouldn't need to worry about this.


if (hash === null || hash === "") {
window.location.href = requestUrl;
} else {
if (sessionStorage.getItem("impersonation_artifacts") === null) {
sessionStorage.setItem("impersonation_artifacts", hash);
}
window.parent.postMessage("impersonation-authorize-request-complete", "*");
}
}
</script>
</body>
</html>
1 change: 1 addition & 0 deletions features/admin.roles.v2/components/edit-role/edit-role-basic.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,6 +238,7 @@ export const BasicRoleDetails: FunctionComponent<BasicRoleProps> = (props: Basic
t("roles:edit.basics.dangerZone.subheader",
{ type: "role" })
}
isButtonDisabled={ isSubmitting || role?.displayName === "impersonate-myaccount" }
onActionClick={ () => onRoleDeleteClicked() }
data-componentid={ `${ componentid }-role-danger-zone` }
/>
Expand Down
6 changes: 4 additions & 2 deletions features/admin.roles.v2/components/edit-role/edit-role.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
import { AppState } from "@wso2is/admin.core.v1/store";
import { UserManagementConstants } from "@wso2is/admin.users.v1/constants";
import { RoleConstants } from "@wso2is/core/constants";
import { hasRequiredScopes, isFeatureEnabled } from "@wso2is/core/helpers";

Check failure on line 23 in features/admin.roles.v2/components/edit-role/edit-role.tsx

View workflow job for this annotation

GitHub Actions / ⬣ ESLint (STATIC ANALYSIS) (lts/*, 8.7.4) 

'hasRequiredScopes' import from '@wso2is/core/helpers' is restricted. Please use "import { useRequiredScopes } from '@wso2is/access-control'" instead. Refer documentation: https://github.com/wso2/identity-apps/blob/master/docs/write-code/PERFORMANCE.md#use-userequiredscopes-hook-instead-of-hasrequiredscopes-function
import {
FeatureAccessConfigInterface,
RolePropertyInterface,
Expand Down Expand Up @@ -127,7 +127,8 @@
render: () => (
<ResourceTab.Pane controlledSegmentation attached={ false }>
<BasicRoleDetails
isReadOnly={ isAdminRole || isEveryoneRole || isReadOnly || isSharedRole }
isReadOnly={ isAdminRole || isEveryoneRole || isReadOnly || isSharedRole
|| roleObject?.displayName == "impersonate-myaccount" }
role={ roleObject }
onRoleUpdate={ onRoleUpdate }
tabIndex={ 0 }
Expand All @@ -140,7 +141,8 @@
render: () => (
<ResourceTab.Pane controlledSegmentation attached={ false }>
<UpdatedRolePermissionDetails
isReadOnly={ isAdminRole || isReadOnly || isSharedRole }
isReadOnly={ isAdminRole || isReadOnly || isSharedRole
|| roleObject?.displayName == "impersonate-myaccount" }
role={ roleObject }
onRoleUpdate={ onRoleUpdate }
tabIndex={ 1 }
Expand Down
3 changes: 2 additions & 1 deletion features/admin.roles.v2/components/role-list.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,13 +17,13 @@
*/

import { Show } from "@wso2is/access-control";
import { FeatureConfigInterface } from "@wso2is/admin.core.v1/models/config";

Check warning on line 20 in features/admin.roles.v2/components/role-list.tsx

View workflow job for this annotation

GitHub Actions / ⬣ ESLint (STATIC ANALYSIS) (lts/*, 8.7.4) 

`@wso2is/admin.core.v1/models/config` import should occur after import of `@wso2is/admin.core.v1/helpers/history`
import { getEmptyPlaceholderIllustrations } from "@wso2is/admin.core.v1/configs/ui";
import { AppConstants } from "@wso2is/admin.core.v1/constants/app-constants";
import { history } from "@wso2is/admin.core.v1/helpers/history";
import { AppState } from "@wso2is/admin.core.v1/store/index";
import { RoleConstants as CommonRoleConstants } from "@wso2is/core/constants";
import { hasRequiredScopes, isFeatureEnabled } from "@wso2is/core/helpers";

Check failure on line 26 in features/admin.roles.v2/components/role-list.tsx

View workflow job for this annotation

GitHub Actions / ⬣ ESLint (STATIC ANALYSIS) (lts/*, 8.7.4) 

'hasRequiredScopes' import from '@wso2is/core/helpers' is restricted. Please use "import { useRequiredScopes } from '@wso2is/access-control'" instead. Refer documentation: https://github.com/wso2/identity-apps/blob/master/docs/write-code/PERFORMANCE.md#use-userequiredscopes-hook-instead-of-hasrequiredscopes-function
import {
FeatureAccessConfigInterface,
IdentifiableComponentInterface,
Expand Down Expand Up @@ -318,7 +318,8 @@
RoleConstants.FEATURE_DICTIONARY.get("ROLE_DELETE"))
|| !hasRequiredScopes(userRolesFeatureConfig,
userRolesFeatureConfig?.scopes?.delete, allowedScopes)
|| isSharedRole;
|| isSharedRole
|| role?.displayName === "impersonate-myaccount";
},
icon: (): SemanticICONS => "trash alternate",
onClick: (e: SyntheticEvent, role: RolesInterface): void => {
Expand Down
Loading
Loading