Impersonation and delegation using Token Exchange examples not working for me

Original message was deleted

bazze•12/10/25, 7:21 AM

DId you hit the "Errors.TokenExchange.Impersonation.PolicyDisabled"? I got the feature enabled but can't figure out how to enable impersonation and get past this error

@Ask Inkeep

GitHub

zitadel/internal/api/oidc/token_exchange.go at main · zitadel/zitadel

ZITADEL - Identity infrastructure, simplified for you. - zitadel/zitadel

Ask Inkeep•12/10/25, 7:21 AM

Thanks for tagging me @bazze. I'll look through relevant sources and get back to you shortly.

Ask Inkeep•12/10/25, 7:22 AM

Answer

To enable impersonation via Token Exchange, you need to configure two separate things:

Enable the "Allow Impersonation" security setting:

Go to "Default settings" → in the sidebar select "Security Settings" → Enable the "Allow Impersonation" setting. (1)

Assign impersonation permissions to the user:

The user performing the impersonation must have one of these management roles assigned:

| Name | Role | Description |
|------|------|-------------|
| IAM Admin Impersonator | IAM_ADMIN_IMPERSONATORIAM_ADMIN_IMPERSONATOR | Allow impersonation of admin and end users from all organizations |
| IAM Impersonator | IAM_END_USER_IMPERSONATORIAM_END_USER_IMPERSONATOR | Allow impersonation of end users from all organizations |
| Org Admin Impersonator | ORG_ADMIN_IMPERSONATORORG_ADMIN_IMPERSONATOR | Allow impersonation of admin and end users from the organization |
| Org Impersonator | ORG_END_USER_IMPERSONATORORG_END_USER_IMPERSONATOR | Allow impersonation of end users from the organization |

The PolicyDisabledPolicyDisabled error you're seeing indicates that the security setting from step 1 is not enabled. Once you enable "Allow Impersonation" in the Security Settings and ensure your impersonating user has the appropriate role, the token exchange for impersonation should work.

Ask Inkeep•12/10/25, 7:22 AM

To learn more, see the sources I considered:

[1] Impersonation and delegation using Token Exchange

Ask Inkeep•12/10/25, 7:22 AM

Feel free to tag @Ask Inkeep with additional questions.

bazze•12/10/25, 7:23 AM

Oh, as easy as that

All good, this solved it!

AAsk Inkeep To learn more, see the sources I considered: [[1] Impersonation and delegatio...

Ask InkeepAPP•12/10/25, 10:59 AM

Glad I could be helpful. Feel free to create a new thread with any new questions you may have.