SuperUser Building Blocks

Note: Review was done in March 2011.

Sakai had the super-user ability where admins could become another person. Typically they use this to investigate student issues (to see what they see).

There are at least two community-developed building blocks that would give similar functionality in Blackboard:

• Impersonate - USF http://projects.oscelot.org/gf/project/impersonate/frs/
• LoginAs - GRCC http://projects.oscelot.org/gf/project/loginas/

Impersonate (v1.0.12)

• More restrictive permissions. Impersonate can only be done by Systems Administrators, not just anyone with access to the system administration page.
• Permissions are now appropriate to the needs of the block.
• Taglibs consistently use bbNG.
• Simple logging of impersonation to Tomcat stdout.

My Findings:

• shows up in Admin tab >  Tools and Utilities
• restricted to System Administrators, so can't be easily given out 

LoginAs (v2.0.0 - to work with 9.1SP4 or later):

This building block allows the administrator to create a valid session as a different user. For the purpose of validating portal customizations or troubleshooting administrators often use multiple accounts to access the system. This method allows the preserve the original password. Access can be granted by Institutional Role, System Role, or Course Membership. It is a parallel to the Unix su command. It effectively allows to impersonate another user. Logging in as system administrators can disallowed in settings.

My Findings:

• Shows up in under the Admin tab > Tools and Utilities
• Can be restricted to an Institutional Role (e.g., I created a Institutional Role called DOMAIN_LOGINAS) also says you can use system roles: System Administrator, System Support, Account Administrator

Note: did not seem to pick up domain admin roles, e.g., if I assigned the Institutional Role DOMAIN_LOGINAS to a domain admin, the building block did not pick it up.

• Can additionally be restricted by Course ID (e.g., membership in a particular course)

In addition to using Roles you can use course membership. Enroll users in a specific course as students and provide Course ID here. Also works for Orgs (if you have Community).

If users do not have access to the Admin tab, but should have access to LoginAs simply provide access to this url in a course or organization: The LoginAs direct URL

Note: In conversation with Syzmon (developer), he recommended using the course membership over the role.  His intention is to simplify the access to courses only in the future (this way basic license clients are covered).  The option will continue to prohibit login as an administrator type account.

• Disallow LoginAs to a System Adminitrator level user (NOTE: DEFAULT IS NO, WHICH MEANS YOU CAN BECOME ADMINISTRATOR)

You can use the Yes string to prevent users from possible privilege escalation activity.
Recommend setting it to Yes. Then if you try to become Administrator, you get "Request denied. Authentication requested for System Administrator: administrator"

• Simple logging to Tomcat logs. It makes it difficult to then easily find out who logged in as whom.

bb-access.log would show entries like:

123.456.789.10 - _2_1 [05/Aug/2011:10:30:50 -0400] "GET 
/webapps/grcc-LoginAs-bb_bb60/index.jsp?username=user2&OriginatingUser=user1
 HTTP/1.1" 200 19571