For some applications it can be advantageous for administration reasons to allow site administrators to login as other users. This is sometimes called user impersonation or "becoming that user".

This tutorial assumes you've set up a very standard Yii web application and was written when 1.1.6 was the current standard. We're also assuming you have a User model that we'll call "User". This is the model that stores your username, password, and other user related account information.

Step 1: UserIdentity

Open your protected.components.UserIdentity class. This should have an existing "authenticate" method that is called by the login form to authenticate a user. Create a static function called Impersonate that looks like this:

public static function impersonate($userId)
{
	$ui = null;
	$user = User::model()->findByPk($userId);
	if($user)
	{	
		$ui = new UserIdentity($user->email, "");
		$ui->_user = $user;
		$ui->_id = $user->id;
		$ui->setState('name', $user->name);
		$ui->errorCode=self::ERROR_NONE;
	}
	return $ui;
}

This function creates a UserIdentity for the specified userId and returns it.

Step 2: Create an impersonate action on your site controller:

public function actionImpersonate($id)
{
	$ui = UserIdentity::impersonate($id);
	if($ui)
		Yii::app()->user->login($ui, 0);
	$this->redirect(Yii::app()->homeUrl);		
}

You can see that we're logging in as the impersonated user by the same method that the standard LoginForm uses. We'll then redirect to the home page of the site as the new user.

Step 3:

Protect your site/impersonate action. Obviously this action is very powerful. Be sure to add it to your restricted access control rules so that only properly authenticated administrators can access it.

Note that you'll have to log out and back in as a site administrator to become a different user.