ZF-Commons/ZfcUser — pull request #190 by mtudor (2012-11-29 11:42:32+00:00)
Title: Impersonate a User

I propose the addition of functionality to the User Service to allow the impersonation of other users without the need for authentication.

I have deliberately not added routes to the functionality as, unless properly protected from unauthorized use, this would allow anyone to login to any account without a password. Obviously a security risk.

It is left up to the implementer to provide whatever interface they need to protect and allow impersonation to take place. In my case, I use BjyAuthorize to limit access to an impersonate route (/admin/user/impersonate/) to administrators only. The /admin/user/unimpersonate route is available to all users.

If you don't want to use impersonation in your application then just don't implement any routes, but for those of us that need it I hope that this PR can address that.

Comments welcome!