Impersonating target account via account redirection
Aspects of the present disclosure relate to systems and methods for impersonating target user accounts via account redirection. In one aspect, a request may be received at a service issued from a temporary account of the service accessed by a client application. It may be determined whether the temporary account is stored in a mapping table comprising one or more temporary accounts mapped to a corresponding impersonation token. When it is determined that the temporary account is stored in the mapping table, the corresponding impersonation token mapped to the temporary account may be identified. The request may be processed in an impersonation mode based on the identified impersonation token.
1. A system comprising:
one or more computer readable storage media; and
program instructions stored on the one or more computer readable storage media that, when executed by at least one processor, cause the at least one processor to at least:
identify, at a service, a request for access to a target account associated with the service, wherein the request is issued from a temporary account associated with the service via a client application;
process the request to identify the temporary account;
search a mapping table to determine that the temporary account is stored therein;
identify, using the mapping table, an impersonation token associated with the temporary account, wherein the mapping table includes one or more temporary accounts mapped to corresponding impersonation tokens;
responsive to identifying the impersonation token, transition to an impersonation mode; and
process the request in the impersonation mode.
2. The system of claim 1 , wherein the impersonation token grants an administrator access rights to the target account.
3. The system of claim 2 , wherein the impersonation mode configures the service to process the request as if the request is issued from the target account while granting the administrator access rights to the target account.
4. The system of claim 1 , wherein to process the request in the impersonation mode the program instructions, when executed by the at least one processor, further cause the at least one processor to exchange an authorization token associated with the temporary account with the identified impersonation token.
5. The system of claim 1 , wherein to process the request in the impersonation mode the program instructions, when executed by the at least one processor, further cause the at least one processor to configure a request execution engine to operate as an administrator impersonating a target user associated with the target account.
6. The system of claim 1 , wherein to process the request in the impersonation mode the program instructions, when executed by the at least one processor, further cause the at least one processor to configure a request execution engine to operate as a target user associated with the target account.
7. The system of claim 1 , wherein the client application is at least one of a mobile application, a sync client, a partner application, and a web application.
8. The system of claim 2 , wherein the access rights granted to the administrator include limited access to the target account.
9. A computer-implemented method of operating a system to impersonate a target account of a service accessed by a client application, the method comprising:
receiving, by the system, a request for access to a target account associated with the service, wherein the request is initiated by a temporary account of the service by the client application;
processing, by one or more processors of the system, the request to identify the temporary account;
searching, by the one or more processors of the system, a mapping table to determine that the temporary account is stored therein,
where the mapping table includes one or more temporary accounts mapped to corresponding impersonation tokens;
responsive to identifying the impersonation token,
transition to an impersonation mode, and
process the request in the impersonation mode.
10. The computer-implemented method of claim 9 , wherein the impersonation token grants an administrator access rights to the target account.
11. The computer-implemented method of claim 10 , wherein the impersonation mode configures the service to process the request as if the request is issued from the target account while granting the administrator access rights to the target account.
12. The computer-implemented method of claim 9 , wherein processing the request in the impersonation mode comprises exchanging an authorization token associated with the temporary account with the identified impersonation token.
13. The computer-implemented method of claim 9 , wherein processing the request in the impersonation mode comprises configuring a request execution engine to operate as an administrator impersonating a target user associated with the target account.
14. The computer-implemented method of claim 9 , wherein processing the request in the impersonation mode comprises configuring a request execution engine to operate as a target user associated with the target account.
15. The computer-implemented method of claim 9 , wherein the client application is at least one of a mobile application, a sync client, a partner application, and a web application.
16. A system comprising:
reception means for receiving a request at a service issued from a temporary account of the service accessed by a client application;
storage means including one or more computer readable storage media for storing a mapping table including one or more temporary accounts mapped to corresponding impersonation tokens;
processing means including one or more processors for:
determining that a temporary account is stored in the mapping table;
identifying a corresponding impersonation token mapped to the temporary account; and
processing the request in an impersonation mode using the identified impersonation token.
17. The system of claim 16 , wherein the impersonation token grants an administrator access rights to a target account, and wherein the impersonation mode configures the service to process the request as if the request is issued from the target account while granting the administrator access rights to the target account.
18. The system of claim 17 , wherein the client application is at least one of a mobile application, a sync client, a partner application, and a web application and wherein the access rights granted to the administrator include limited access to the target account.
19. The system of claim 16 , wherein the means for processing the request in the impersonation mode further comprises exchanging an authorization token associated with the temporary account with the identified impersonation token.
20. The system of claim 16 , wherein the means for processing the request in the impersonation mode further comprises configuring a request execution engine to operate as an administrator impersonating a target user.