User impersonation - Can I get id programmatically on behalf of another user?

Question

Is it possible using user impersonation to get an ID token on behalf of another user?

Lets say I have an admin user (user A) that can impersonate other users, and I have another user (user B) that logins in the application using his Identity Provider.

Is it possible for this user A to get an ID token (through api) on behalf of user B?

Answer 1

Hi OctavioCunha-8450 I want to help you with this question.

If I understand you right, you want to have a user principal who has the privilege to act on behalf of another user.

If the identity of (admin A) could be another EA app in the AzureAD, then you are able to act on behalf of another user in application B and get the user token.

I make a quick search and found the following, related thread: https://stackoverflow.com/questions/74516076/how-to-impersonate-user-of-other-azure-ad-app

Maybe it helps you in your scenario too.

---

If the reply was helpful, please don’t forget to upvote or accept it as an answer, thank you.

Answer 2

Hello @OctavioCunha-8450 , for custom or complex Azure AD B2C flows, you need to switch to Custom Policies. Take a look to the Impersonation Flow for Azure AD B2C sample. For ID token refresh you will need to add a new OrchestrationStep (before SendClaims) with a new ClaimsExchange that would reference a new TechnicalProfile that calls the AAD-ImpersonatedUserRead technical profile (similar to SelfAsserted-TargetEmailExchange but of Protocol Name=None). Keep in mind you will need to pass the targetemail claim as a query param during the token refresh call. You can call API during refresh token as usual.

Let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.