User Impersonation
Details
| Detail name | Value |
|---|---|
| Changelog Number | 5045 |
| Type | New Feature |
| Status | Resolved |
| Fix Versions | Exasol 6.1.0 |
| Resolution Date | 2018-05-03 |
Background
For customers who cannot or do not prefer using Kerberos or LDAP as a means to achieve Single-Sign-On through third-party clients, an alternative approach is provided with the User Impersonation feature.
Feature description
The User Impersonation feature allows one user with appropriate privilege to impersonate (assume identity of) another user.
To impersonate a target user, the impersonating user should have the system privilege IMPERSONATE ANY USER or the specific impersonation privilege IMPERSONATION ON target_user_role on the target user or one of the roles granted to the target user. The user can use the IMPERSONATE statement to impersonate the target user.
Once user Alice impersonates user Bob, the EFFECTIVE_USER of the session is changed to Bob. The user loses all privileges and roles granted to Alice and receives the privileges and roles granted to Bob. All queries hereafter are executed in the context of Bob.
Benefits
User Impersonation is provided as an alternative approach to Single-Sign-On through third party clients. After the user authenticates itself to the third party client, the client authenticates with Exasol using the credentials of a special Technical User. The Technical User has privileges to impersonate other users. The client then executes the IMPERSONATE statement to impersonate the actual user.
Restrictions
- The IMPERSONATE statement causes an implicit commit, and reverting the impersonation is not possible.
- Impersonation is not allowed if the active transaction has acquired WRITE LOCKS. The user must first commit or rollback the active transaction before using the IMPERSONATE statement.
