Impersonate error with 2FA enabled users

Steps to reproduce

1. create group 2FA
2. enable 2FA for that group with the plugin
3. create user with 2FA allowed
4. in the admin "user" settings, attempt to impersonate that user
5. error returned (some details obfuscated)

Internal Server Error

The server encountered an internal error and was unable to complete your request.

Please contact the server administrator if this error reappears multiple times, please include the technical details below in your report.

More details can be found in the server log.

Technical details

    Remote Address: 128.250.0.###
    Request ID: 1ygqvDoj###h2g3Sdudz

Reloading does not help, but using the back operation in the browser it is possible to get to the impersonated user.

The error only occurs with users who have 2FA support enabled (note that in this example, the user has not actually set up 2FA yet).

Server configuration

Operating system: Debian Jessie

Web server: Apache2

Database: Mariadb

PHP version: 7.0.20-2

Nextcloud version: 12.0.3

Start by reproducing the failure from the admin "user" settings with a user whose group has 2FA enabled, and inspect the server log using the reported request details. Trace the impersonation flow and 2FA handling; done means administrators can impersonate users with 2FA support enabled without an internal server error.