# How to Modify Access Token with acts\_as claim to imitate user impersonation

**URL:** <https://community.auth0.com/t/how-to-modify-access-token-with-acts-as-claim-to-imitate-user-impersonation/83203>\
**Category:** Get Help\
**Tags:** impersonation, user-impersonation, auth0\
**Created:** [May 10, 2022, 9:04pm UTC](https://community.auth0.com/t/how-to-modify-access-token-with-acts-as-claim-to-imitate-user-impersonation/83203 "2022-05-10T21:04:41Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![dominic1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dominic1/32/37213_2.png) [@dominic1](https://community.auth0.com/u/dominic1)\
**Post date:** [May 10, 2022, 9:04pm UTC](https://community.auth0.com/t/how-to-modify-access-token-with-acts-as-claim-to-imitate-user-impersonation/83203/1 "2022-05-10T21:04:41Z")

</div>

Understanding that true user impersonation isn’t possible, my proposed solution to mimic impersonation by adding a claim to the JWT so that my JWT still has my user’s sub but it also has metadata that the app can reference to treat the admin as another user.

Is there a way to refresh a user’s JWT with mutated claims out of scope of their login? When I log in, my JWT might look like this:

```auto
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

```

and then when I take an action to act as another user, it might look like this:

```auto
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "acts_as: "987654321"
}

```

Thanks!

---

<div class="post-metadata">

**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\
**Post date:** [May 11, 2022, 1:27pm UTC](https://community.auth0.com/t/how-to-modify-access-token-with-acts-as-claim-to-imitate-user-impersonation/83203/3 "2022-05-11T13:27:31Z")

</div>

Hey @dominic1

You will need an action or a rule to modify the access token, and because the claim is not a standard claim, you will need to namespace it, like [https://mynamespace.mydomain.com/acts\_as](https://mynamespace.mydomain.com/acts_as) instead of just acts\_as.

This is a good way to do impersonation, just make sure to log everything as “User John Doe/1516…22 performed actions X on behalf of user 987…321”, getting both users in the log message to make it clear.

John

---

<div class="post-metadata">

**Author:** ![dominic1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dominic1/32/37213_2.png) [@dominic1](https://community.auth0.com/u/dominic1)\
**Post date:** [May 11, 2022, 1:36pm UTC](https://community.auth0.com/t/how-to-modify-access-token-with-acts-as-claim-to-imitate-user-impersonation/83203/4 "2022-05-11T13:36:12Z")

</div>

Thanks, John!

I should have been more clear. The namespacing and auditing I understand. I’m curious how to mutate the JWT out of scope of a login event.  
For example, Joe Admin logs in at 10am. At 10:15am he goes to the list of users, finds Jane User, and clicks a button to impersonate her. How do I mutate that JWT to add the acts\_as claim?

Thanks again.

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [May 11, 2022, 5:03pm UTC](https://community.auth0.com/t/how-to-modify-access-token-with-acts-as-claim-to-imitate-user-impersonation/83203/5 "2022-05-11T17:03:21Z")

</div>

Hey @dominic1 welcome to the community!

> [@dominic1](#):
>
> I’m curious how to mutate the JWT out of scope of a login event.

I’m not sure this is possible without requesting a new JWT - Perhaps you could look into using [silent auth](https://auth0.com/docs/authenticate/login/configure-silent-authentication)? You might also be able to work something into [using a refresh token](https://auth0.com/docs/secure/tokens/refresh-tokens/use-refresh-tokens) since it sounds like it would just require a new claim (as opposed to a new scope). FWIW, rules/actions will be run on the refresh token request as well.

---

<div class="post-metadata">

**Author:** ![dominic1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dominic1/32/37213_2.png) [@dominic1](https://community.auth0.com/u/dominic1)\
**Post date:** [May 11, 2022, 9:02pm UTC](https://community.auth0.com/t/how-to-modify-access-token-with-acts-as-claim-to-imitate-user-impersonation/83203/7 "2022-05-11T21:02:12Z")

</div>

Ahh that’s super helpful @ty.frith thank you! I will experiment with that

---

<div class="post-metadata">

**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\
**Post date:** [May 12, 2022, 2:03pm UTC](https://community.auth0.com/t/how-to-modify-access-token-with-acts-as-claim-to-imitate-user-impersonation/83203/8 "2022-05-12T14:03:38Z")

</div>

Yes, what @ty.frith said - use silent auth to get a new token. – j

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [May 27, 2022, 2:04pm UTC](https://community.auth0.com/t/how-to-modify-access-token-with-acts-as-claim-to-imitate-user-impersonation/83203/9 "2022-05-27T14:04:11Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.