{"action":"created","issue":{"url":"https://api.github.com/repos/symfony/symfony/issues/18406","repository_url":"https://api.github.com/repos/symfony/symfony","labels_url":"https://api.github.com/repos/symfony/symfony/issues/18406/labels{/name}","comments_url":"https://api.github.com/repos/symfony/symfony/issues/18406/comments","events_url":"https://api.github.com/repos/symfony/symfony/issues/18406/events","html_url":"https://github.com/symfony/symfony/issues/18406","id":145177479,"number":18406,"title":"Impersonate an user when using REMOTE_USER","user":{"login":"bertoost","id":398492,"avatar_url":"https://avatars.githubusercontent.com/u/398492?v=3","gravatar_id":"","url":"https://api.github.com/users/bertoost","html_url":"https://github.com/bertoost","followers_url":"https://api.github.com/users/bertoost/followers","following_url":"https://api.github.com/users/bertoost/following{/other_user}","gists_url":"https://api.github.com/users/bertoost/gists{/gist_id}","starred_url":"https://api.github.com/users/bertoost/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bertoost/subscriptions","organizations_url":"https://api.github.com/users/bertoost/orgs","repos_url":"https://api.github.com/users/bertoost/repos","events_url":"https://api.github.com/users/bertoost/events{/privacy}","received_events_url":"https://api.github.com/users/bertoost/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/symfony/symfony/labels/Bug","name":"Bug","color":"e10c02"},{"url":"https://api.github.com/repos/symfony/symfony/labels/Security","name":"Security","color":"DDDDDD"},{"url":"https://api.github.com/repos/symfony/symfony/labels/Status:%20Needs%20Review","name":"Status: Needs Review","color":"ededed"},{"url":"https://api.github.com/repos/symfony/symfony/labels/Unconfirmed","name":"Unconfirmed","color":"444444"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-04-01T13:11:48Z","updated_at":"2016-04-01T13:28:40Z","closed_at":null,"body":"When switching user when you're using the REMOTE_USER setup, it will switch you back every time within a couple of seconds. It's not possible to swich user this way.\r\n\r\nTried to overwrite the security token etc. but that also ends in the same result.\r\n\r\nThe \"impersonated\" user does get an updated last login time (FOSUserBundle) in both situations, but the REMOTE_USER is still leading and I am still myself :-)\r\n\r\nAnyone facing this issue?\r\nWould be great to use Symfony's switch feature."},"comment":{"url":"https://api.github.com/repos/symfony/symfony/issues/comments/204396350","html_url":"https://github.com/symfony/symfony/issues/18406#issuecomment-204396350","issue_url":"https://api.github.com/repos/symfony/symfony/issues/18406","id":204396350,"user":{"login":"stof","id":439401,"avatar_url":"https://avatars.githubusercontent.com/u/439401?v=3","gravatar_id":"","url":"https://api.github.com/users/stof","html_url":"https://github.com/stof","followers_url":"https://api.github.com/users/stof/followers","following_url":"https://api.github.com/users/stof/following{/other_user}","gists_url":"https://api.github.com/users/stof/gists{/gist_id}","starred_url":"https://api.github.com/users/stof/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stof/subscriptions","organizations_url":"https://api.github.com/users/stof/orgs","repos_url":"https://api.github.com/users/stof/repos","events_url":"https://api.github.com/users/stof/events{/privacy}","received_events_url":"https://api.github.com/users/stof/received_events","type":"User","site_admin":false},"created_at":"2016-04-01T13:28:40Z","updated_at":"2016-04-01T13:28:40Z","body":"REMOTE_USER is meant to be a stateless auth model. The browser sends the auth with each request.\r\nSo when switching user, the next request is again authenticating with the original user, leading to the behavior you see.\r\nThe impersonation feature of Symfony requires that the authentication state is maintained server-side. For stateless auth systems where the client maintains this state, it cannot work, as you would have to impersonate client-side (which is where the state is)"}}