Working with Delegation and Impersonation
1. Understanding Delegation Concepts
| Term | Detail |
|---|---|
| Delegation | User grants subset of perms to another principal |
| Impersonation | Admin acts as another user (full identity) |
| On-behalf-of | Service acts on behalf of original user |
2. Implementing User Impersonation
| Requirement | Detail |
|---|---|
| Permission | Restricted role (e.g., support_impersonator) |
| Audit | Log impersonator + target + reason ticket |
| Banner | UI always shows "Impersonating X" |
| Token | Contains both sub (target) and act (actor) |
3. Using OAuth Delegation
| Grant | RFC |
|---|---|
| Authorization code | User delegates to client |
| Token exchange | RFC 8693 — actor + subject tokens |
| Rich Authorization Requests | RFC 9396 fine-grained scopes |
4. Implementing Service Account Delegation
| Cloud | Detail |
|---|---|
| GCP | Service account impersonation via IAM iam.serviceAccountTokenCreator |
| AWS | STS AssumeRole |
| Azure | Workload Identity Federation |
5. Using Delegation Scopes
Example: RFC 8693 token-exchange
POST /token
grant_type=urn:ietf:params:oauth:grant-type:token-exchange
subject_token=<user-token>
subject_token_type=urn:ietf:params:oauth:token-type:access_token
actor_token=<service-token>
requested_token_type=urn:ietf:params:oauth:token-type:access_token
scope=orders:read6. Auditing Delegated Actions
| Log Field | Detail |
|---|---|
| actor | Who is acting |
| subject | On whose behalf |
| action | What operation |
| reason | Ticket / business justification |
| timestamp | UTC + duration |
7. Implementing Delegation Expiration
| Type | TTL |
|---|---|
| Impersonation session | 15-30 min, auto-end |
| Vacation delegation | Fixed end date |
| Action-bound | Single-use (e.g., one approval) |
8. Preventing Delegation Abuse
| Control | Detail |
|---|---|
| No re-delegation | Delegatee cannot delegate further |
| Scope cap | Cannot exceed delegator's permissions |
| Step-up MFA | For sensitive impersonation |
| Notify subject | Email user when impersonated |
9. Using Constrained Delegation
| System | Detail |
|---|---|
| Kerberos S4U2Proxy | Service delegates only to allowed targets |
| OAuth audience-restricted | Token usable only at named service |
| Resource-bound | Per-object scopes (RAR) |
10. Implementing Delegation Revocation
| Mechanism | Detail |
|---|---|
| By delegator | Self-service revoke |
| By admin | Emergency revoke |
| Automatic | On role change / termination |
| Token revocation | RFC 7009 endpoint |