User impersonation with ASP.NET Forms Authentication

Question

Scenario: In an e-commerce system, a helpdesk user should be able to "impersonate" or "log on as" a specific customer (from the web-based administration site) so that he can support the customer first-hand - eg. when the Customer is on the phone.

Additional clarification: There is no need to keep track of the original authentication context. We simply need to provide a "Log on as" button that will log on as the customer without the helpdesk user needing to know the password.

Any ideas how this scenario could be implemented using regular ASP.NET Forms Authentication?

Answer 1

Maybee I don't understand the scenario exactly. But why not let the support login as the user?

FormsAuthentication.SetAuthCookie("yourCustomersUserName");

Then it will be up to the e-commerce system to have an updated "cart" or whatever so the support can help..

Answer 2

I was able to get this to work, assuming you've got a user already logged in, you can impersonate another user with the below code.

FormsAuthentication.SignOut();

FormsAuthentication.SetAuthCookie("username", true );