Impersonation - Great Tool for Testing Customizations

Monday, October 31, 2016 by Rainer Stropek

Time cockpit's customization options are one of its most important unique selling propositions. You will find many SaaS offerings for time tracking nowadays. Many of them are designed to be a simple as possible. If you need exactly what they offer, they are a great fit. At time cockpit, we believe that every customer has unique requirements. Their internal processes (e.g. project management), pricing models, etc. differentiate them from their competitors. Thus, we have built time cockpit so that you can tailor it to your specific needs. Data model, lists, forms, reports, workflows, permissions - everything can be customized and extended. You can even add more complex functionalities by using time cockpit's scripting language (Python) or its RESTful Web API.

Testing in the Sandbox

The initial setting up of B2B SaaS solution is relatively easy as you do not have to consider users depending on it for their daily work. You can easily make configuration changes and try them.

Things change fundamentally after putting the SaaS solution in production. Over time, additional changes or extensions will be necessary. Likely, you cannot fiddle around with the production system as you might break it at least temporarily. Even worse, your changes might lead to wrong results (e.g. invoices, payroll processes).

Time cockpit supports staging environments for development and testing. We call these environments Sandboxes.

A few months ago, my colleague Alexander Huber wrote a blog article Playing in the Sandbox. In his article, he describes in detail, what sandboxes are and how they work. Alexander also included tips about how to use sandboxes together with time cockpit's scripting capabilities.

Testing of Permissions with Impersonation

Sandboxes are a great tool for testing customizations. Even with a sandbox it isn't simple to test functions that depend on the current user. Some of our customers have quite sophisticated permission systems. Trying functions with different user accounts becomes crucial in this context. Of course, it would be possible to ask users for their passwords and us it to login on their behalf. However, that would not be a professional solution. Time cockpit had to come up with a better solution.

The full client has had an Impersonation-feature since the early days of time cockpit. As an administrator, you can open the Customization module and select Change identity. With that, you can take the role of another user. You will see time cockpit as this user would see it until you click Restore identity.

Note that because of security reasons, impersonation is only available for time cockpit administrators. This restriction applies to the full client and the HTML5 client.

This month, we added support for impersonation to the HTML5 client, too. Administrators find a new menu item Impersonate in the Settings section:

Next, they can select the appropriate user:

Once done, the administrator can hit Restore Identity in the Settings menu to switch back to her own user.

Technical Background

If you have a technical background, you might wonder how this works in the background. Let me describe what's happening so you see that impersonation is not a security threat for your time cockpit environment.

First, let me emphasize again that impersonation is only available for time cockpit administrators. Client and server make sure that only administrators can initiate and use impersonation features.

Technically, impersonation sets a marker in the HTML5 client. It will set a HTTP header for each RESTful Web API request sent to the server. The following picture shows a typical request that the HTML5 client sends to the server with the impersonation header set:

The server first verifies that the real user is administrator. If she is, the impersonation header is read and the requested operation is performed in the name of the impersonated user.

Restoring the identity simply stops the client from sending the impersonation header.