7

I have started to test my Managed app through different user Profiles.

Manage User -> User_1 -> [Login] link near each user allowed me to impersonate any user Profile.

This is a cool feature provided by Salesforce to test a feature across different profiles very efficiently.

  1. When I try to access a VisualForce Page by directly logging in as Particular user say test_user_1 I am able to see that page.

  2. But when I try to impersonate the User test_user_1 I am getting a message like this on the particular page:

Insufficient Privileges You do not have the level of access necessary to perform the operation you requested. Please contact the owner of the record or your administrator if access is necessary.

I checked the VisualForce page Security settings and the Profile already has access to that Page. I don't understand what prevents Salesforce from showing the VisualForce page while impersonating but displays the same page on Actual User login.

Update:

I forgot to mention I am using SAML as Authentication mode and this page exactly explains what I am facing.

http://help.bluemangolearning.com/m/salesforce/l/71245-salesforce-saml-troubleshooting-insufficient-privileges

Improve this question
3
  • 3
    Actually not! Once the user has permission to the page, they have permission to the controller, and to any classes called in turn from the controller. na10.salesforce.com/help/doc/en/pages_page_level_security.htm
    – Doug B
    Sep 12, 2013 at 14:22
  • The User Profile has access to both Page and Controller and it works perfectly while login with particular users credentials. But it only shows this message while I login thru Admin Manage users.
    – karthikselva
    Sep 12, 2013 at 14:24
  • @DougB Cool tip Doug, thx!
    – Sergej Utko
    Sep 12, 2013 at 14:27

1 Answer 1

Reset to default
4

Seems like there is no work around to Use 'login as' feature with SAML enabled and if there is any, they are considered to Security Holes in the implementation by Salesforce.

I got this excerpt from one of the Salesforce Knowledge base mentioned here http://help.salesforce.com/apex/HTViewSolution?id=000175641&language=en_US

Insufficient Privileges when logged in as another user

Knowledge Article Number: 000175641

Description

User has implemented a SAML SSO solution from Salesforce to an external Java app using Salesforce as the identity provider. We're using the FederationIdentifier field from the standard User object in the SAML assertion. The solution works great when a user is logged in as him/herself, but it doesn't work when a user is logged in as another user and giving Insufficient Privileges error.

Insufficient Privileges

You do not have the level of access necessary to perform the operation you requested. Please contact the owner of the record or your administrator if access is necessary.

Internal Diagnostics:

Cannot use IdP while SU'd as another user system.security.NoAccessException: Cannot use IdP while SU'd as another user

Resolution

The error message explains it nicely : We actively block SSO logins when you are logged in as a different user. 'Login as' is meant to enable Salesforce admins to support their salesforce users but it can definitely not be used as a 'backdoor' to gain access to other systems as that user. That would be a huge security hole no.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.