Is it possible for an administrator to impersonate other accounts

Question

Service accounts are often used when external services (or build scripts) require API access to TeamCity. The best practice in this case is to create a different service account for each external service.

Is there a functionality for an administrator to manage those tokens in a centralized manner? Can an administrator impersonate these service accounts?

Answer

It is possible to turn on this feature by setting the teamcity.internal.accessTokens.enableCreationForOtherUsers=true internal property.

Keep in mind that this allows administrators to create access tokens in the name of other users, which means that those actions would appear as performed by those other users. This is a very sensitive security-related topic and should be implemented carefully.

Additional information

allow administrators to manage access tokens for service accounts