Tiggywiggler (24/05/2017)
Would you be happy for the agent to be logged in as the customer even without being given the username / password?
You could directly instruct the login system to load the security profile of the customer against the session being used by the agent and then every request that the agent makes to the ASP.Net application will have a authentication cookie that maps to the customer.
We actually do something quite similar to this with our recruitment (job board) software. An admin in the backend can search for candidates, or recruiters/employers. There is then a small button by the results to enable the admin to login as that user. It uses the password hash to login which it pulls from the client/candidate's record - since it uses a special back end login page to do that it doesn't hash the entered value (since its already hashed). It would be effectively like enabling you to login as a customer by using their hashed, rather than unhashed password. Since this script is a back end one the person using it must be logged into the backend (and hence having authenticated with an admin password).
The admin of course never knows the original plain text password (as in theory that is impossible to obtain).
I guess it would be a useful feature on Kartris. Our recruitment software is much older so its classic asp, but I don't think it would be a massive task to rewrite the code in asp.net.