feat: user impersonation (Skeleton Key) for admin support #265

New Issue

2026-06-23T18:19:37Z

jmiller commented

2026-06-23 18:19:37 +00:00

User Impersonation (Skeleton Key)

Overview

Allow Super Admins to log into the frontend as any other user without knowing their password. Essential for support/debugging — see exactly what a user sees. Based on Akeeba Skeleton Key (GPLv3).

Features

"Login As" button on admin Users list next to each user
Cookie-based auth — short-lived token in #__user_keys, single-use
ACL controls:
- Configurable groups that can impersonate (default: Super Admin)
- Configurable groups that can be impersonated (default: Registered)
- Configurable groups that cannot be impersonated (default: Admin, Super Admin)
Action logging — log who impersonated whom
Cookie security — hashed user agent, HttpOnly, Secure, SameSite=Strict
Auto-destroy — cookie destroyed after single use

Architecture

Integrated into core system plugin (not separate plugin)
AJAX endpoint for creating impersonation cookie
Authentication handled in onUserAuthenticate event
Frontend onAfterInitialise checks for cookie and auto-logs in
Admin onBeforeDisplay adds login buttons to Users list
JS injects buttons into user list rows

Security

CSRF token required for AJAX request
Group-based ACL (who can/cannot be impersonated)
Token stored hashed in #__user_keys
Cookie lifetime configurable (default: 10 seconds)
Action log entry created for audit trail
Single-use tokens — destroyed after login

Config Fields

skeleton_key_enabled — master toggle (default: off)
skeleton_key_control_groups — groups allowed to impersonate
skeleton_key_target_groups — groups that can be impersonated
skeleton_key_blocked_groups — groups that cannot be impersonated
skeleton_key_cookie_lifetime — cookie TTL in seconds

Reference

Based on Akeeba Skeleton Key v1.2.3 (GPLv3) — reimplemented as integrated feature.

## User Impersonation (Skeleton Key) ### Overview Allow Super Admins to log into the frontend as any other user without knowing their password. Essential for support/debugging — see exactly what a user sees. Based on Akeeba Skeleton Key (GPLv3). ### Features - **"Login As" button** on admin Users list next to each user - **Cookie-based auth** — short-lived token in `#__user_keys`, single-use - **ACL controls:** - Configurable groups that can impersonate (default: Super Admin) - Configurable groups that can be impersonated (default: Registered) - Configurable groups that cannot be impersonated (default: Admin, Super Admin) - **Action logging** — log who impersonated whom - **Cookie security** — hashed user agent, HttpOnly, Secure, SameSite=Strict - **Auto-destroy** — cookie destroyed after single use ### Architecture - Integrated into core system plugin (not separate plugin) - AJAX endpoint for creating impersonation cookie - Authentication handled in `onUserAuthenticate` event - Frontend `onAfterInitialise` checks for cookie and auto-logs in - Admin `onBeforeDisplay` adds login buttons to Users list - JS injects buttons into user list rows ### Security - CSRF token required for AJAX request - Group-based ACL (who can/cannot be impersonated) - Token stored hashed in `#__user_keys` - Cookie lifetime configurable (default: 10 seconds) - Action log entry created for audit trail - Single-use tokens — destroyed after login ### Config Fields - `skeleton_key_enabled` — master toggle (default: off) - `skeleton_key_control_groups` — groups allowed to impersonate - `skeleton_key_target_groups` — groups that can be impersonated - `skeleton_key_blocked_groups` — groups that cannot be impersonated - `skeleton_key_cookie_lifetime` — cookie TTL in seconds ### Reference Based on Akeeba Skeleton Key v1.2.3 (GPLv3) — reimplemented as integrated feature.

jmiller added this to the v03.00.00 milestone 2026-06-23 18:19:37 +00:00

jmiller commented

2026-06-23 19:10:58 +00:00

Branch created: feature/265-feat-user-impersonation-skeleton-key-for

git fetch origin
git checkout feature/265-feat-user-impersonation-skeleton-key-for

Branch created: [`feature/265-feat-user-impersonation-skeleton-key-for`](https://git.mokoconsulting.tech/MokoConsulting/MokoSuiteClient/src/branch/feature/265-feat-user-impersonation-skeleton-key-for) ```bash git fetch origin git checkout feature/265-feat-user-impersonation-skeleton-key-for ```

Sign in to join this conversation.

Priority Medium

Type Feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoSuiteClient#265