Create a logged "Impersonate User" feature for TRIRIGA Administrators

The current methods of troubleshooting user-specific issues that only show in production environments configured for SSO are as follows:

1) Have two different authentication methods: App server has SSO enabled, Process server has SSO not enabled. TRIRIGA admin uses process server to login as the affected user to troubleshoot. (Some security concerns with this method - admins can arbitrarily login as anyone and perform arbitrary actions without it easily tracing back to them).

2) TRIRIGA Administrator modifies their account to "swap" usernames between the affected user and their account so they can natively login as the affected user (requires to TRIRIGA Admins, one who does the swap and another who can set it back - also same security concerns as option 1).

3) TRIRIGA Administrator does a screenshare with the user to validate the issue and attempts to replicate the issue under their own profiles by reconfiguring their own profile to match the user's profile (time intensive and not always possible due to work shift differences in a 24-hr work environment).

Moving forward with TAS/MREF, I don't believe option 1 will be available anymore. Option 2 and 3 would still work, but they are not particularly efficient or effective in testing as the user. The options are even fewer with TRIRIGA authentication, as the administrator would likely not know the user's password and would have to reset it in order to impersonate the user.

I propose that an "Impersonate User" function be created for use exclusively by TRIRIGA administrators that allows them to impersonate users temporarily and log the access as them doing impersonation. I envision it would be similar to how other systems do it, like ServiceNow, where a button would be available only for Administrators on their home portal (maybe in the MyProfile menu?). When a user is selected, the administrator would temporarily login as the selected user and a log would be generated either in the Security log file or directly on the people record showing who initiated the impersonation and when. Even better if it annotates in the Audit tab of any record modified, created or deleted by the administrator while impersonating. Something like "Revise User, End 123456 (Impersonated) 3/12/2025". The option could also have a time limit to ensure it isn't accidentally left on and possibly even a notification could be sent to the affected end user notifying them of the impersonation.