"Sign In As" seems broken

Problem Statement

I can't use the Sign In As feature to act as a lower-permissioned user from the CMS Admin position.

Steps to Reproduce

• Log into demo.dotcms.com, or a local instance, as admin.
• Try to use Sign In As
• Be immediately logged out

https://github.com/user-attachments/assets/e8f0e163-c1af-4f56-a79a-116b50560f13

I also tested this on an older version (26.03.20-1) and found a different, but still fatal, error. It still failed to perform the Sign In As function, but it did so with an error message about lacking a password — despite never prompting for one, nor ever having needed one in the past.

(Screenshot courtesy of @jorgecgll, who had the same issue earlier.)

Acceptance Criteria

Sign In As should allow you to assume a lesser user's role.

dotCMS Version

26.04.06-01, 26.03.20-01, possibly others.

Severity

High - Major functionality broken

Links

https://dotcms.slack.com/archives/C028Z3R2D/p1775580226804109

Start by reproducing the Sign In As flow in dotCMS 26.04.06-01 or a local instance, using the CMS Admin position and a lower-permissioned user. Trace the authentication and authorization entry points reached when the session logs out or reports a missing password. Done means an admin can assume the lesser user's role without being logged out or receiving the password error.