管理员以用户身份登录而不知道用户密码？

Question

I am trying to provide an admin functionality where an admin is able to login as another user without knowing their password. All the site content is permission controlled. My questions are -

• Should I logout the admin user before switching to the user account? Does that mean admin have to re-login?
• If I need to switch back to admin account - how do I go about this as the "User" don't have admin permissions but I previously logged in as an admin?
• Any other thing I need to keep in mind?

What do you suggest?

Answer 1

I'm not familiar with CI, but here's a generic solution:

When choosing to impersonate a user, you:

• Store the user id in the session as admin user id.
• Replace the user id in the session with the target user id (i.e. do whatever would happen during a successful login)

If an admin user id is present in the session, display an "end impersonation" link somewhere. When clicking that link, you:

• Replace the user id in the session with the admin user id.
• Remove the admin user id from the session.