Skip to main content

User Impersonation

Last updated on

User Impersonation lets account administrators temporarily act as another user in the account, including other administrators, without needing that user's password. When user impersonation is in action, you see exactly what the user sees and you can perform actions on their behalf.

Use impersonation is used to reproduce a problem a user reports, or to confirm that a user has the intended set of permissions before you hand off access. Every impersonation session requires a reason, notifies the impersonated user by email, and is recorded in the Audit Trail.

What will you learn in this topic?​

By the end of this topic, you will be able to:

  • Start an impersonation session: Impersonate a user from Access Control and record a reason for the session.
  • Manage the session: Track the remaining time, end the session early, and restart it when needed.
  • Trace impersonated activity: Identify the impersonator and the impersonated user in pipeline execution history and in the Audit Trail.
  • Know the boundaries: Understand which scopes and actions impersonation does not support.

Before you begin​

To impersonate a user, ensure you have the following:

  • Account Admin role: Only a user with the Account Admin role can impersonate other users. An administrator assigns this role through RBAC in Harness.
  • Account scope access: Impersonation is available only at the account scope, under Account Settings > Access Control > Users.
  • A target user who has signed in at least once: Users who have never logged in cannot be impersonated.

Demo video​

Watch a walkthrough of an impersonation session before you run one yourself.

Impersonate a user​

Complete the following steps to start an impersonation session and act on behalf of another user.

  1. Navigate to Account Settings, select Access Control, then select Users.

  2. For the user you want to impersonate, click the More icon on the right, then select Impersonate User.

    The Users list with the More icon expanded and the Impersonate User option highlighted

    Select Impersonate User from the More menu next to the user you want to impersonate.

  3. Enter a valid reason for the session, then click Start Impersonation. A reason is required for every session.

    Dialog prompting for an impersonation reason with the Start Impersonation button

    Harness records the reason you enter alongside the impersonation audit events.

    note

    When impersonation starts, Harness sends an email to alert the user being impersonated.

  4. Work as the impersonated user. The session lasts 30 minutes, and a banner at the top of the screen shows the remaining time.

    Banner at the top of the Harness UI showing the remaining impersonation session time

    The banner tracks how much time remains in the 30-minute session.

End or restart a session​

You do not have to wait for the 30 minutes to elapse. Complete the following steps to end a session and decide what happens next.

  1. Click End Session on the top banner to end the session before it expires.

  2. When the session ends, either because you ended it or because it timed out, a prompt appears. Select Restart Session to begin a new session for the same user, or select Quit to return to your own account context.

    Prompt after an impersonation session ends offering Restart Session and Quit options

    Restart the session to continue troubleshooting, or quit to return to your own user context.

View impersonated user info​

Actions taken during a session remain traceable to both users. In the pipeline execution history, Harness shows the impersonator and the impersonated user, so you can tell who triggered an execution and on whose behalf.

Pipeline execution history showing both the impersonator and the impersonated user

Pipeline execution history identifies both the impersonator and the impersonated user.

Impersonation session audit events​

Harness fires a Start impersonation audit event at the beginning of a session, and an End impersonation audit event when the session concludes or times out.

Every audit event fired during the session is tagged with the impersonator and impersonated user details. Review these events on the Audit Trail page. The Action column shows the activity, and the User column indicates who was impersonated and by whom.

Audit Trail page showing impersonation events with the Action and User columns

The Audit Trail records who was impersonated, by whom, and what they did.

Limitations​

Impersonation is deliberately restricted so it cannot be used to change account-level security settings or credentials.

  • Account scope only: The Impersonate User option is available only at the account scope.
  • First login required: Only users who have logged in at least once can be impersonated.
  • Self-impersonation is not supported: You cannot impersonate your own user.
  • Unsupported during a session: You cannot do the following while you impersonate a user:

Troubleshooting​

The Impersonate User option does not appear in the Harness Access Control users list

Confirm you are at the account scope and that your user has the Account Admin role. The option is not available at the organization or project scope.

Harness does not let me impersonate a specific user in my account

The user must have logged in to Harness at least once, and you cannot impersonate your own user.

Harness impersonation session ended unexpectedly before I finished troubleshooting

Impersonation sessions expire after 30 minutes. Select Restart Session on the prompt that appears to start a new session for the same user.

An action fails with a permission error while impersonating a user in Harness

Impersonation grants only the impersonated user's permissions, not your own. Verify the permissions assigned to that user, and check whether the action is on the list of unsupported impersonation actions.

I cannot tell which Harness user actually ran a pipeline during an impersonation session

Pipeline execution history and the Audit Trail both record the impersonator and the impersonated user for every action taken during a session.

Next steps​

You can now impersonate a user to reproduce their experience, verify their access, and trace every action back to both users through the Audit Trail.