Uploaded image for project: 'OpenShift Console'
  1. OpenShift Console
  2. CONSOLE-4734

Enable Multi-Group User Impersonation in OpenShift Web Console

XMLWordPrintable

    • Icon: Story Story
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • None
    • None
    • None
    • None
    • None
    • OCP Console - Sprint 278

      As a cluster administrator want to impersonate a user with multiple group memberships simultaneously, so that I can accurately reproduce their effective permissions and troubleshoot RBAC issues.

      Currently, the OpenShift Web Console only supports impersonating either:

      • A single user (Impersonate-User: <username>)
      • A single group (Impersonate-Group: <groupname>)

      This limitation prevents administrators and support personnel from accurately reproducing a target user's effective permissions when that user belongs to multiple groups. The oc CLI already supports this via repeated --as-group flags:
       

      oc --as=user1 --as-group=developers --as-group=admins --as-group=monitoring get pods

       

      Backend Changes

      • Proxy: Already supports multiple Impersonate-Group headers
      • WebSocket: Extend subprotocol parsing for multiple groups
      • GraphQL: Update context handling for multiple groups

      UI Components

      AC:

      • Support simultaneous user + multiple group impersonation
        • Set Impersonate-User: <username> header
        • Set multiple Impersonate-Group: <group> headers (one per group)
      • Provide intuitive UI for multi-group selection based on the UX input
      • Update Redux state to support multiple groups
        • Extend ImpersonateKind type to support group array
        • Maintain backward compatibility with existing single-group state
        • Handle state transitions between single and multi-group modes
      • WebSocket support for multi-group impersonation

       

      UX Spec: https://issues.redhat.com/browse/HPUX-741

          1.
          		 Add the End-to-End Tests to the multi-group impersonation feature Sub-task To Do Undefined Unassigned
          2.
          		 Adding the Frontend Tests for the multi-group impersonation featuree Sub-task To Do Undefined Unassigned
          3.
          		 Adding the unit test for the multi-group impersonation backend changes Sub-task To Do Undefined Unassigned
          4.
          		 Create the UI Actions for multi-group impersonation Sub-task To Do Undefined Leo Li
          5.
          		 Backend Request Headers Updates for multi-group impersonation Sub-task To Do Undefined Leo Li
          6.
          		 Redux Actions & States Updates for multi-group impersonation Sub-task To Do Undefined Unassigned
          7.
          		 Redux Type Extensions for multi-group impersonation Sub-task Code Review Undefined Leo Li
          8.
          		 GraphQL Context Updates Sub-task To Do Undefined Leo Li
          9.
          		 WebSocket Subprotocol Parsing for multi-group impersonation Sub-task To Do Undefined Leo Li
          10.
          		 Adding the auto-complete feature for the group impersonation modal Sub-task To Do Undefined Unassigned
          11.
          		 Create the group impersonation modal Sub-task To Do Undefined Leo Li
          12.
          		 Create the feature flag to hide this feature, as used for development purposes Sub-task Code Review Undefined Leo Li
          13.
          		 Remove the impersonate-enable feature flag when feature is ready for release Sub-task To Do Undefined Unassigned
          14.
          		 Update the Impersonation banner to correctly display the impersonated groups and user Sub-task To Do Undefined Unassigned

              rh-ee-leoli Leo Li
              jhadvig@redhat.com Jakub Hadvig
              None
              None
              Yanping Zhang Yanping Zhang
              None
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated: