title: How to Grant Permission to IMPERSONATE any other user?
body: <p>In order to log the usage of an application I am developing I need every user using my application to execute queries against my SQL Server Database under their own credentials.</p>
  
  <p>In order to <em>not</em> be storing their passwords in a retrievable fashion, I can't be creating a connection on a per-user basis (because that would entail knowing their password past the brief window when they log-in).</p>
  
  <p>The, seemingly obvious, solution to this problem (which may be sub-optimal) is to run all sensitive queries as a generic "Application" user, impersonating the logged in user (requiring me to only associate the logged in user with a username...which is not a bad thing).</p>
  
  <p>My problem is that I'm not sure how to grant impersonate to all users of a certain role, or all users in general (not the brightest idea, because I don't want the app impersonating a sysadmin, for instance).</p>
  
  <pre><code>grant impersonate on all to ApplicationLogin
  </code></pre>
  
  <p>doesn't work, and there's no documentation that I can find that suggests granting impersonation on members of a role would be doable...</p>
  
  <p>Any ideas?</p>