Impersonate a User

Impersonation allows you to query data as another Immuta user. If you don't see instructions for using impersonation for your data platform on this page, the integration does not support it. See the Integrations overview page to view a list of integrations and the Immuta features they support.

Impersonating users in projects

If you are impersonating a user who is currently in a project, you will only see data sources within that project. For details about this behavior, see the description of project contexts.

Amazon Redshift Spectrum

1. Run the following in Redshift:

   CALL immuta_procedures.impersonate_user(<Immuta username of the user to impersonate>)

2. Run queries.

To end user impersonation in Redshift, run

CALL immuta_procedures.impersonate_user(NULL)

User impersonation is specific to the script and session in which it was set. Using a new script or running a subset of script queries without setting the context will result in the queries being run as the regular user.

Azure Synapse Analytics

1. Run the following command in Azure Synapse Analytics:

   EXEC sys.sp_set_session_context @key = N'immuta_user',
   @value = '<Synapse username linked to the Immuta user you want to impersonate>';

2. Run queries.

To end user impersonation in Synapse, run

EXEC sys.sp_set_session_context @key = N'NULL', @value = 'NULL'

User impersonation is specific to the script and session in which it was set. Opening a new script will revert the user back to themselves.

Databricks Spark

The Databricks Unity Catalog integration does not support user impersonation.

1. Run the following SQL command in Databricks to set the user you want to impersonate:

   %sql
   set [email protected]

2. Run queries as the impersonated Immuta user:

   %sql
   set [email protected]
   select * from demo.hr_data limit 10;

To end user impersonation for the session, run

%sql
set immuta.impersonate.user=

Snowflake

Requirement

The impersonator and impersonatee cannot be the user who registered the Snowflake connection or a policy-exempt user.

Impersonate a Snowflake user

1. Open a New Worksheet and set your role to the impersonation role that was created for Snowflake when configuring the integration.

2. Run the following command:

   SET immuta_user = '<Immuta username of the user to impersonate>'

3. Run queries within that worksheet.

Impersonation is specific to the worksheet and session in which it was set. Opening a new worksheet will revert the user back to themselves.

Scope of impersonation

When impersonating another user, you can only view data sources that you're subscribed to. See the Snowflake integration reference guide for details.

Starburst (Trino)

The Starburst (Trino) integration supports the native Starburst or Trino impersonation approaches:

• JDBC method: In your JDBC connection driver properties, set the sessionUser property to the Immuta user you want to impersonate. See the Starburst JDBC driver documentation for details.

• Trino CLI method: Set the --session-user property to specify the session user as the Immuta user you want to impersonate when invoking the Trino CLI. See the Trino release notes for details.

To view the user you are impersonating, run SHOW SESSION like 'immuta.immuta_user'.

To end user impersonation, run RESET SESSION immuta.immuta_user.

Your permission to impersonate users is not checked until the query is run. If you do not have the IMPERSONATE_USER permission in Immuta, you will be able to run the command to impersonate a user, but you will not be able to query as that user.