What Is an Impersonator?
Example: Using impersonation in a front-end/back-end network configuration.
The user connects to one of the front-end servers (containing the search interface) via the intranet in order to query the back-end server (containing the index). If impersonation is not configured, the user security token is transmitted to the front-end server but cannot be retransmitted to the back-end server, because Windows prevents this double-hop. Therefore, the index cannot verify the user permissions and returns only documents available to everyone. However, if the front-end server has impersonator privileges, no token is exchanged between the user and server; instead, the front-end server assumes the identity of the user and sends the token directly to the back-end server—which returns all documents the user is allowed to open.
To allow impersonation, the front-end server address must be entered in the Impersonators list (see Granting Impersonator Privileges).