Impersonation Security concerns

Issue

• Impersonation is a powerful feature of Liferay. This article serves to answer the following questions regarding its security. 

1. Who triggers the impersonation request?
   
2. How long that kind of access will be used?
   
3. What audit controls are in place for the use of this feature?
   
4. How you control and assure the feature is just used by the authorized person?

Environment

• DXP 7.2+

Resolution

• Who can trigger the impersonation request?

  How we control and assure the feature is just used by the authorized person for the authorized ends?

  The answer to both of these questions are similar, so I will answer them together. 
  This feature is only available for users that have the correct permissions. You can find out what roles have permission to use this feature under Control panel -> Users and Organizations -> Roles -> Select a role you want to review -> Define permissions
  From the categories select Control panel -> Users and Organizations -> Users ​ and under Resource permissions Impersonate​ should be there. Users who use a role that allows them to impersonate will be able to use this feature. 

• What audit controls are in place for the use of this feature?

  Under Control Panel -> Configuration -> Audit​ you can see if an IMPERSONATION​ request has been sent. If you click on this event you will be able to see the user that initiated the impersonation request and the impersonated user's username and id in the additional information field. 

• How long that kind of access will be used?

  There is no time restriction on how long can this access be used. Once the person who initiated the request decides that the impersonation is no longer needed, that is when the impersonation ends.