diff --git a/package-lock.json b/package-lock.json
index f9d9172..8532553 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -18417,7 +18417,7 @@
     },
     "packages/2fa": {
       "name": "@digabi/2fa",
-      "version": "2.1.0",
+      "version": "3.0.0",
       "license": "EUPL-1.2",
       "dependencies": {
         "qr": "^0.5.2"
@@ -18737,7 +18737,7 @@
     },
     "packages/user-management": {
       "name": "@digabi/user-management",
-      "version": "0.4.0",
+      "version": "0.6.0-fixUserForAuthentication.1",
       "license": "EUPL-1.2",
       "dependencies": {
         "@digabi/validation": "^3.1.0",
diff --git a/packages/2fa/package.json b/packages/2fa/package.json
index 67e5fab..440a914 100644
--- a/packages/2fa/package.json
+++ b/packages/2fa/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@digabi/2fa",
-  "version": "2.1.0",
+  "version": "3.0.0",
   "author": "Matriculation Examination Board, Finland",
   "license": "EUPL-1.2",
   "repository": {
diff --git a/packages/user-management/package.json b/packages/user-management/package.json
index d6558df..e1d4c17 100644
--- a/packages/user-management/package.json
+++ b/packages/user-management/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@digabi/user-management",
-  "version": "0.4.0",
+  "version": "0.6.0-fixUserForAuthentication.1",
   "author": "Matriculation Examination Board, Finland",
   "license": "EUPL-1.2",
   "repository": {
diff --git a/packages/user-management/src/user-types.ts b/packages/user-management/src/user-types.ts
index a7f7654..b002db6 100644
--- a/packages/user-management/src/user-types.ts
+++ b/packages/user-management/src/user-types.ts
@@ -18,13 +18,13 @@ export const PrincipalOrganizationSchema = z.object({
 
 export type Impersonation = z.infer<typeof ImpersonationSchema>
 export const ImpersonationSchema = z.object({
-  id: z.number(),
+  id: z.uuid(),
   realSsn: zodSsn,
-  impersonatedSsn: zodSsn,
+  impersonatedSsn: zodSsn.or(z.literal('')),
   explanation: z.string(),
   validityStart: z.string(),
   validityEnd: z.string(),
-  schoolUuid: z.string().optional()
+  schoolUuid: z.string().nullish()
 })
 
 export type MockUser = z.infer<typeof MockUserSchema>
@@ -141,8 +141,9 @@ export const UserSchema = StoredUserDetailsSchema.extend({
   ssn: zodSsn,
   userAccountId: z.string(),
   schools: z.array(UserSchoolSchema),
-  censorRole: CensorRoleSchema.optional()
-})
+  censorRole: CensorRoleSchema.optional(),
+  impersonation: z.never().optional()
+}).strict()
 
 export type UserToUpsert = z.infer<typeof UserToUpsertSchema>
 export const UserToUpsertSchema = UserDetailsSchema.extend({
@@ -150,16 +151,32 @@ export const UserToUpsertSchema = UserDetailsSchema.extend({
   schools: z.array(UserSchoolToUpsertSchema)
 }).strict()
 
-export type ImpersonatedUser = z.infer<typeof ImpersonatedUserSchema>
-const ImpersonatedUserSchema = z.object({
-  ssn: z.string(),
-  schools: z.array(UserSchoolSchema),
-  impersonation: ImpersonationSchema,
-  censorRole: CensorRoleSchema.optional()
-})
+export type PersonalImpersonation = z.infer<typeof PersonalImpersonationSchema>
+export const PersonalImpersonationSchema = UserSchema.extend({
+  impersonation: ImpersonationSchema
+}).strict()
 
+export type SchoolImpersonation = z.infer<typeof SchoolImpersonationSchema>
+export const SchoolImpersonationSchema = z
+  .object({
+    impersonation: ImpersonationSchema,
+    ssn: z.literal('IMPERSONATED'),
+    schools: z
+      .array(
+        z.object({
+          schoolId: z.string(),
+          principal: z.literal(true),
+          permissions: z.array(z.unknown()).max(0, "Impersonated principal doesn't have other permissions")
+        })
+      )
+      .max(1, 'Impersonated principal has one school')
+  })
+  .strict()
+
+export type ImpersonatedUser = z.infer<typeof ImpersonatedUserSchema>
+export const ImpersonatedUserSchema = z.xor([PersonalImpersonationSchema, SchoolImpersonationSchema])
 export type UserForAuthentication = z.infer<typeof UserForAuthenticationSchema>
-export const UserForAuthenticationSchema = z.union([UserSchema, ImpersonatedUserSchema])
+export const UserForAuthenticationSchema = z.xor([UserSchema, ImpersonatedUserSchema])
 
 export type UserWithSchoolRoleAndSchoolId = z.infer<typeof UserWithSchoolRoleAndSchoolIdSchema>
 export const UserWithSchoolRoleAndSchoolIdSchema = z.object({