Hi Decsope team, I am looking for assistance. I have setup all the users of my tenant to a special role called

global_admin

on the project-level. This role has the

Impersonate

permission. I visually confirm that my user and other users in my tenant have the same parameters in the UI. However, my impersonation attempt succeeds while other users' attempts fails. I feel that I need somebody from your support team to look on your backend as the experience is inconsistent despite what seems like identical set-up.

Hey Boris, thanks for reaching out. Please DM me your Project ID.

Hey @Boris Danilovich can we have a quick call ?

Hi @Atharva Joshi, thanks for the reach out. I am checking for a bug on our side, will update shortly. CC: @Dima Aronov

Sure I'll just drop a small summary here for you - from what Aditya shared, the user facing the problem and has the global_admin permission is a SSO user. And the Issue persists with non-SSO user. What is happening is when you sign in with OAuth, it counts as another user so you. must be seeing duplicate users with the same email ids. due to this the oauth user doesnt have the impersonate permission. To handle this, you'll either need to - • Merge the users Oauth and SSO identity • Enforce SSO so the user can only log in through that. Doing so he will get access to the permission Please make sure you log in with SSO inside the impersonation flow PS - if you're using the default impersonation flow from templates, it should have a check in the if condition that checks if the user has the permission, else it will show a screen that user has insufficient permissions to impersonate @Akash Jivane please follow up here

Thank you both for your assistance