FWIW, with the ability we now have to return data directly from the backend to the frontend (as announced in this recent demo / Q&A by Josh and Emmanuel), there’s no need for an API Connector call; so it’s even simpler. Just return the login link and visit it using the Open an external website action.
A couple of important notes though…
-
Make sure there’s a condition on the “Log in as” button’s workflow which checks that the current user has the appropriate permissions (e.g.
Current User's Roles contains Admin). In your case, if you’re running a multi-tenant SaaS, this might entail checking if the person the property manager is attempting to “impersonate” is actually one of their tenants. It’s also advisable to protect the backend custom event with a condition as well. -
When generating the login link, I would also suggest minimizing the potential “attack surface” by setting the link expiration to a fractional value. I generally use
0.005, which is 18 seconds.
