Detect an impersonated session

ServiceNow's impersonation detection uses two different APIs that return opposite contexts: gs.getUserID() returns the impersonated user while session.getProperty('glide.authenticate.sysid') returns the real user. Most developers expect gs.getUserID() to always return the authenticated user's ID, but during impersonation it flips to show the impersonated user. This creates confusion in audit trails and access control logic where you need both identities.

When to use this

• Building audit trails that need to capture both the real user and impersonated user
• Implementing access control exceptions that bypass normal ACLs during impersonation
• Creating approval workflows where impersonated actions require different routing logic
• Server-side business rules that need to differentiate between direct user actions and impersonated ones

When NOT to use this

• Don't use in client scripts — session APIs aren't available, use GlideAjax instead
• Don't use in scheduled jobs — they run as system user and isImpersonating() always returns false
• Don't use for general user identification — stick to gs.getUserID() unless you specifically need impersonation context
• Don't use in catalog client scripts — they run in an iframe with different session context

Key behaviors and gotchas

• session.isImpersonating() returns false in background processors and import jobs even when they were triggered during impersonation
• glide.authenticate.sysid session property is only set during interactive impersonation, not programmatic gs.getUser().impersonate()
• Domain separation affects impersonation — you can only impersonate users in domains you have access to
• gs.isInteractive() stays true during impersonation but becomes false in async jobs spawned from impersonated sessions
• Scoped applications can't detect impersonation of users outside their scope unless they have global read access