OSDOCS-17807: document multi-group user impersonation in the web console

OSDOCS-17807: Split impersonation procedures into modules

OSDOCS-17807: Split impersonation procedures into modules

authentication/impersonating-system-admin.adoc

@@ -12,4 +12,10 @@ include::modules/impersonation-system-admin-user.adoc[leveloffset=+1]
 
 include::modules/impersonation-system-admin-group.adoc[leveloffset=+1]
 
+include::modules/impersonation-multiple-groups-web-console.adoc[leveloffset=+1]
+
+include::modules/starting-impersonation-users-groups-pages.adoc[leveloffset=+1]
+
+include::modules/stopping-impersonation.adoc[leveloffset=+1]
+
 include::modules/unauthenticated-users-cluster-role-binding.adoc[leveloffset=+1]

modules/impersonation-multiple-groups-web-console.adoc

@@ -0,0 +1,29 @@
+:_mod-docs-content-type: PROCEDURE
+[id="impersonating-user-multiple-group-memberships-web-console"]
+= Impersonating a user with multiple group memberships in the web console
+
+[role="_abstract"]
+You can start user impersonation from multiple locations in the {product-title} Console. Depending on where you start, you can impersonate a single user, a single group, or a user with one or more group memberships.
+
+.Prerequisites
+* You must be logged in to the {product-title} web console as a user with permission to impersonate other users.
+* The user or group that you want to impersonate must already exist.
+
+[NOTE]
+====
+The impersonated user can belong to zero or more groups.
+====
+
+.Procedure
+. From the **Overview** page in the {product-title} console, click your user name and select **Impersonate User**.
+. In the **Username** field in the **Impersonate** dialog, enter the name of the user you want to impersonate.
+. Optional: In the **Groups** field, choose one or more groups that are associated with the user.
++
+The dialog displays a warning message explaining that impersonation applies the effective permissions of the specified user and any selected groups.
+
+. Click **Impersonate** to impersonate your selected user, groups, or both.
+
+[NOTE]
+====
+Selecting one group uses the existing single-group impersonation behavior. Selecting no groups uses regular single-user impersonation.
+====

modules/impersonation-system-admin-user.adoc

@@ -6,8 +6,7 @@
 [id="impersonation-system-admin-user_{context}"]
 = Impersonating the system:admin user
 
-You can grant a user permission to impersonate `system:admin`, which grants them
-cluster administrator permissions.
+You can use the OpenShift web console to impersonate a user and select multiple group memberships at the same time to reproduce that user’s effective permissions.
 
 .Procedure
 
@@ -38,3 +37,15 @@ subjects:
   name: <username>
 ----
 ====
+
+
+
+
+
+
+
+
+
+
+
+

modules/starting-impersonation-users-groups-pages.adoc

@@ -0,0 +1,11 @@
+:_mod-docs-content-type: PROCEDURE
+[id="starting-impersonation-users-groups-pages"]
+= Starting impersonation from the Users or Groups pages
+
+[role="_abstract"]
+You can start impersonation for users or groups from the **Users** or **Groups** pages in the {product-title} Console.
+
+.Procedure
+. From the **Overview** page in the {product-title} console, click **User Management** → **Users**.
+. Open the menu for the user you want to impersonate and select **Impersonate User**.
+. Optional: To impersonate a group, click **User Management** → **Groups**, click the menu for that group, and select **Impersonate Group**.

modules/stopping-impersonation.adoc

@@ -0,0 +1,10 @@
+:_mod-docs-content-type: PROCEDURE
+[id="stopping-impersonation"]
+= Stopping impersonation
+
+[role="_abstract"]
+You can stop impersonating a user or group at any time from the {product-title} Console.
+
+.Procedure
+. On any page in the {product-title} console, click **Stop impersonating** at the top of the page.
+. Alternatively, click your user name and select **Stop impersonating**.