I have the following setup: all CM users are Azure AD users, all CM groups have Azure as identity provider and are mapped to appropriate Azure AD groups. No users is explicitly added to CM groups. Everything works fine when using the CM.
I have following Core service script that needs to impersonates various users to perform some actions:
..... coreServiceClient.Impersonate(userName) ... CoreServiceClient.GetSystemWideList.... ....
Unfortunately get returns 0 items.
I have added Azure AD user explicitly to the group in the CM (the same one he already has access to through Azure AD) and the script now works fine (50 items are returned and can be processed further).
It seems that when impersonating a user that has membership set through external identity provider (like Azure AD) the core service doesn't properly identify access privileges.
How can I fix this?