We have a Sitecore MVC website. The Sitecore version is 9.3.0.
As of now, we have login functionality on the website. We use 'AuthenticationManager.Login' method and pass 3 parameters(username, password and persistent).
We have a new requirement that one user(let's consider as a superuser) should be able to log in using his credentials. Once the superuser is logged in, he will be able to impersonate another user(using only the userId and without entering a password).
So now two sessions are active. One is the actual superuser logged in using his credentials. The second is the impersonating user. While impersonating, he can do few operations on the website like ordering something or managing his profile details, etc.
Superuser must be able to stop the impersonation and also to log out from his account. Can you please help me on how to achieve this requirement? Please share your thoughts/inputs on this requirement.