API
Version 7.x > API > Kentico 7 : Using impersonation + windows authentication only View modes: 
User avatar
Member
Member
maryka - 7/1/2013 10:05:17 PM
   
Kentico 7 : Using impersonation + windows authentication only
After impersonating normal AD user with no administrative rights at all, is there a way to switch back to my own user which has global admin rights? Note: Normal AD users only have read access throughout the site and do not have rights to edit content neither to access CMS desk.

Cheers

User avatar
Kentico Legend
Kentico Legend
Brenden Kehren - 7/1/2013 10:33:31 PM
   
RE:Kentico 7 : Using impersonation + windows authentication only
It depends on how you have your website setup. If you have created a login webpart that has the "impersonation" abilities within it, then yes. If no, then you have to physically log out of that user and log back in as yourself. I do have some code that does this, if you'd like I can share.

User avatar
Member
Member
maryka - 7/2/2013 2:03:56 AM
   
RE:Kentico 7 : Using impersonation + windows authentication only
The site has been set up using the default windows authentication and AD security. I was trying to test different user rights by simple clicking the down pointing arrow next to my login name in CMS desk and then -> impersonate. Most of the users do not have access to the CMS desk but we have multiple Active directory groups that we have bring across to the website and each group has different security rules applied to it.
At the moment to switch back to my admin user I need to shut down all the instances of browser and navigate back to the website, for it to recognise my AD login.

Any code that can improve or help with this situation will be great.

User avatar
Kentico Legend
Kentico Legend
Brenden Kehren - 7/2/2013 10:27:25 AM
   
RE:Kentico 7 : Using impersonation + windows authentication only
By default "Global Administrators" will only have access to this impersonation feature. If you are impersonating a user that has access to CMSDesk, simply click the dropdown arrow and click Cancel Impersonation and it will log you back in.

If not here is some custom web part code I created to do the impersonation. When its complete it displays a "welcome <username> floated left and a sign in/out button floated right. To the left of the username is that dropdown arrow for impersonation:
<%@ Register Src="~/CMSAdminControls/UI/UniSelector/UniSelector.ascx" TagName="UniSelectorControl" TagPrefix="cms" %>
<div id="membership" class="row">
<div class="first six columns">
<asp:Label ID="lblLabel" runat="server" CssClass="CurrentUserLabel" EnableViewState="false" /> 
<asp:Literal ID="ltrSignLink" runat="server" EnableViewState="false" />
<asp:PlaceHolder runat="server" ID="pnlUsers" Visible="false">
<div class="hide">
<cms:UniSelectorControl ID="ucUsers" ShortID="us" ObjectType="CMS.User" runat="server"
ReturnColumnName="UserName" SelectionMode="SingleButton" IsLiveSite="false" DisplayNameFormat="##USERDISPLAYFORMAT##" />
</div>
<cms:ContextMenuContainer runat="server" ID="menuCont">
<asp:ImageButton runat="server" ID="imgImpersonate" />
</cms:ContextMenuContainer>
<cms:CMSUpdatePanel runat="server" ID="pnlHiddenImpersonate">
<ContentTemplate>
<asp:Button ID="btnHiddenImpersonate" runat="server" OnClick="btnHiddenImpersonate_Click" />
</ContentTemplate>
</cms:CMSUpdatePanel>
</asp:PlaceHolder>
</div>
<div class="last six columns textRight">
<div class="lastlogin">
<asp:Literal ID="litLastLogin" runat="server" EnableViewState="false" />
</div>
<cms:CMSButton ID="btnSignOut" runat="server" OnClick="btnSignOut_Click" CssClass="signoutButton" EnableViewState="false" />
<asp:LinkButton ID="btnSignOutLink" runat="server" OnClick="btnSignOut_Click" CssClass="signoutLink" EnableViewState="false" />
</div>
</div>
There are two methods you need to have. This one will be called in the protected override void OnLoad(EventArgs e) method every time the page is loaded.
private void CheckUserImpersonate()
{
CurrentUserInfo user = CMSContext.CurrentUser;

string originalUserName = "";

if (RequestHelper.IsFormsAuthentication())
{
originalUserName = ValidationHelper.GetString(SessionHelper.GetValue("OriginalUserName"), "");
}
else
{
originalUserName = ValidationHelper.GetString(SessionHelper.GetValue("ImpersonateUserName"), "");
}

// Show impersonate button for global admin only or impersonated user
if ((user.IsGlobalAdministrator) || (!String.IsNullOrEmpty(originalUserName)))
{
// only display the impersonate if in the "cards" section
pnlUsers.Visible = (CMSContext.CurrentDocument.NodeAliasPath.Contains("Cards"));

// Set context menu for impersonate
imgImpersonate.ImageUrl = GetImageUrl("~/App_Themes/MySite/Images/Misc/ArrowRed.png");
menuCont.MenuControlPath = "~/CMSAdminControls/ContextMenus/UserImpersonateMenu.ascx";
menuCont.MenuID = ClientID + "m_impersonate_context_menu";
menuCont.ParentElementClientID = ClientID;
menuCont.Parameter = "''";
menuCont.RenderAsTag = HtmlTextWriterTag.A;
menuCont.MouseButton = MouseButtonEnum.Both;
menuCont.VerticalPosition = VerticalPositionEnum.Bottom;
menuCont.HorizontalPosition = HorizontalPositionEnum.Left;

// Hide button for cancel impersonation
btnHiddenImpersonate.Style.Add("display", "none");

if (user.IsGlobalAdministrator || CMSContext.CurrentUser.IsInRole("KwikTripCreditDepartment", CMSContext.CurrentSiteName))
{
ucUsers.WhereCondition = "UserID IN (SELECT UserID FROM CMS_UserSite WHERE (UserIsGlobalAdministrator = 0)) AND (UserID != " + user.UserID + ") AND (UserName != N'public')";
pnlUsers.Visible = true;
}
else
{
// not needed
}
//Script for open uniselector modal dialog
string impersonateScript = "function userImpersonateShowDialog () {US_SelectionDialog_" + ucUsers.ClientID + "()}";
ScriptHelper.RegisterClientScriptBlock(this, typeof(string), "ImpersonateContextMenu", ScriptHelper.GetScript(impersonateScript));

string userName = HttpUtility.UrlDecode(ValidationHelper.GetString(ucUsers.Value, String.Empty));
if (userName != String.Empty)
{
// Get selected user info
UserInfo iui = UserInfoProvider.GetUserInfo(userName);
SessionHelper.SetValue("OriginalUserName", CMSContext.CurrentUser.UserName);
SessionHelper.SetValue("OriginalUserNameHash", EncryptionHelper.EncryptData(SecurityHelper.GetSHA2Hash(CMSContext.CurrentUser.GetStringValue("UserPassword", ""))));
user.UserImpersonate(iui, ResolveUrl("~/Cards/My-Card/"));
}

// Set script for cancel impersonation only if original user name is specified
if (!String.IsNullOrEmpty(originalUserName))
{
string script = "function CancelImpersonation() {document.getElementById('" + btnHiddenImpersonate.ClientID + "').click();return false;}";
ScriptHelper.RegisterClientScriptBlock(this, typeof(string), "CancelImpersonation", ScriptHelper.GetScript(script));
}
}
}
This method actually performs the impersonation.
    /// <summary>
///
/// </summary>
/// <param name="sender"></param>
/// <param name="e"></param>
protected void btnHiddenImpersonate_Click(object sender, EventArgs e)
{
string originalUserName = ValidationHelper.GetString(SessionHelper.GetValue("OriginalUserName"), "");

if (RequestHelper.IsFormsAuthentication())
{
UserInfo ui = UserInfoProvider.GetUserInfo(originalUserName);
CMSContext.CurrentUser.UserImpersonate(ui, ResolveUrl("~/Cards/"));
}
else
{
SessionHelper.SetValue("ImpersonateUserName", null);
SessionHelper.SetValue("OriginalUserName", null);
CMSContext.CurrentUser.Invalidate(false);

// Log event
EventLogProvider log = new EventLogProvider();
log.LogEvent(EventLogProvider.EVENT_TYPE_INFORMATION, DateTime.Now, "Administration", "Impersonate", 0, null, 0, null, null, "User " + originalUserName + " has returned to his account.", CMSContext.CurrentSiteID, URLHelper.CurrentURL);
// send them back where they came from
URLHelper.Redirect(URLHelper.CurrentURL);
}
}
Hopefully this gets you going in the right direction.