Admin to Impersonate User

[Eolesen]

I've looked but maybe am not winning the "how would a search engine say this" battle today...

In other platforms, there's an ability for admins to impersonate a user to verify permission and other issues....

Is there such a mod for vB 4.x or 5.x? If not, it's something that's invaluable from a support level.

Short of zapping their password and asking them to reset it later, I can't think of another good way to debug what is causing two issues with a "black swan" problem with their subscription permissions. The user I created to test with isn't experiencing the same, nor are all the other people who've bought the new subscription within the last week.

Maybe a way to bypass the password validation for a specific IP that's approved for debugging?...

I guess I could store the hash somewhere in the database but there has to be an easier way that won't mess with the ability of someone to use the platform while I'm debugging their issue.....

<rant over />

[glennrocksvb]

I have this mod but not yet publicly available. It works but it needs some improvements. Switching back to the original user requires logging out and manually logging back in. It would be nice to switch back with a single click.

I also want to take privacy into consideration by not allowing PM to be read. What do you think, should this be implemented?

[Eolesen]

Well, anyone who knows how to read the database tables can read PM's.... just as anyone who is a system administrator knows how to read emails... having the power and using it are two different things.

[glennrocksvb]

in vB5, the PMs are stored in multiple database tables together with forum posts, blogs, articles, groups, visitor messages, channels, etc. You'd have to know how the tables are structured and join multiple tables and filter out non-PMs in order to retrieve the PM threads. So reading the PMs directly from the database is not as easy as reading emails.

[Eolesen]

It's definitely a lot more complex than it was in vb4. If you do make the mod available, let me know.

[tearjerkers]

This would be a great tool to have. We had this ability back in PHBB3, and I've missed it since switching to VB.

[Eolesen]

I think the bigger benefit for having impersonation available would be for testing roles and functional visibility. Posting as someone else or reading/sending PM's would be a bit problematic.

[glennrocksvb]

In some cases, you'd still need to post on behalf of a user if you were testing posting issues by the user.

It would be complicated (if at all possible within the capabilities of the plugin system) to prevent the impersonator from posting in forum or reading/sending PM's or restricting access to certain pages or functionalities. That's why I decided to just add plugin settings for limiting who can impersonate and who can be impersonated by user ids and/or usergroups.

I also added a prompt to warn the impersonating user of the dangers of this tool and confirm if they still want to proceed.

[glennrocksvb]

I also plan to add logging to log the date and time a user impersonated another.

[Eolesen]

Logging is good, but will there be a notice to the user that somebody had logged in as them? Not saying it needs to be there, but it might be a reasonable option to consider for transparency and accountability.

[glennrocksvb]

That's a reasonable option. I can add that option to send an email to the user and ask the impersonating user a reason why they are impersonating and include it in the email.

[glennrocksvb]

This mod is now available at:

https://vbmods.rocks/forum/vbulletin-5-modifications/vbulletin-5-products-and-extensions/27332-admin-view-as-user