Sign In

Impersonation Mode

If you offer a way for your employees to log in as your customers, you need to inform Castle to ignore this activity to avoid false alerts being triggered.

You need to call impersonate before the employee logs into your customer’s account, which means it needs to go before the $login.succeeded event is tracked.

Example

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
    # request from your admin UI e.g. ActiveAdmin

    member_action :become, method: :get do
      user = User.find(params[:id])
      response = castle.impersonate(
        user_id: '1234',
        impersonator: 'optional_admin_id_or_email'
      )
      bypass_sign_in(user, scope: :user)
      redirect_to root_path
    end
  
Field Type Description
user_id String identifier of the impersonated user.
impersonator String (optional) identifier of the admin user.
context Object request context (client_id, ip, user-agent are required) - autogenerated by SDKs

Note

impersonate request should be made before you login your support engineer into a end-user account. client_id is required - if you have not integrated with c.js or Castle mobile SDK’s on the client-side, you will be unable to use the /impersonate endpoint.


Impersonation Reset

Impersonation is by default canceled by calling $logout.succeeded event.

1
2
3
4
5
    response = castle.track(
      event: '$logout.succeeded',
      user_id: '1234'
    )
  
Field Type Description
user_id String identifier of the impersonated user.
context Object request context (client_id, ip, user-agent are required) - autogenerated by SDKs