diff --git a/gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java b/gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java
index 42fc815..ee8d100 100644
--- a/gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java
+++ b/gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java
@@ -145,7 +145,7 @@
   private static final String TARGET_ENDPOINT_PULIC_CERT_PEM = TOKEN_PARAM_PREFIX + "target.endpoint.cert.pem";
   static final String QUERY_PARAMETER_DOAS = "doAs";
   static final String PROXYUSER_PREFIX = TOKEN_PARAM_PREFIX + "proxyuser";
-  private static final String IMPERSONATION_ENABLED_PARAM = TOKEN_PARAM_PREFIX + "impersonation.enabled";
+  static final String IMPERSONATION_ENABLED_PARAM = TOKEN_PARAM_PREFIX + "impersonation.enabled";
   private static final String IMPERSONATION_ENABLED_TEXT = "impersonationEnabled";
   public static final String KNOX_TOKEN_INCLUDE_GROUPS = TOKEN_PARAM_PREFIX + "include.groups";
   public static final String KNOX_TOKEN_ISSUER = TOKEN_PARAM_PREFIX + "issuer";
@@ -173,6 +173,7 @@
   private int tokenLimitPerUser;
   private boolean includeGroupsInTokenAllowed;
   private String tokenIssuer;
+  private boolean impersonationEnabled;
 
   enum UserLimitExceededAction {REMOVE_OLDEST, RETURN_ERROR};
   private UserLimitExceededAction userLimitExceededAction = UserLimitExceededAction.RETURN_ERROR;
@@ -269,6 +270,12 @@
       endpointPublicCert = targetEndpointPublicCert;
     }
 
+    // KnoxToken impersonation should be configurable regardless of the token state
+    // management status (i.e. even if token state management is enabled users
+    // should be able to opt-out token impersonation
+    final String impersonationEnabledValue = context.getInitParameter(IMPERSONATION_ENABLED_PARAM);
+    impersonationEnabled = impersonationEnabledValue == null ? Boolean.TRUE : Boolean.parseBoolean(impersonationEnabledValue);
+
     // If server-managed token expiration is configured, set the token state service
     if (isServerManagedTokenStateEnabled()) {
       String topologyName = getTopologyName();
@@ -314,11 +321,15 @@
       } else {
         log.noRenewersConfigured(topologyName);
       }
+
+      // refreshing Hadoop ProxyUser groups config only makes sense if token state management is turned on
+      // and impersonation is enabled
+      if (impersonationEnabled) {
+        final Configuration conf = AuthFilterUtils.getProxyUserConfiguration(context, PROXYUSER_PREFIX);
+        ProxyUsers.refreshSuperUserGroupsConfiguration(conf, PROXYUSER_PREFIX);
+      }
     }
     setTokenStateServiceStatusMap();
-
-    final Configuration conf = AuthFilterUtils.getProxyUserConfiguration(context, PROXYUSER_PREFIX);
-    ProxyUsers.refreshSuperUserGroupsConfiguration(conf, PROXYUSER_PREFIX);
   }
 
   private String getTokenTTLAsText() {
@@ -368,9 +379,7 @@
     final Boolean lifespanInputEnabled = lifespanInputEnabledValue == null ? Boolean.TRUE : Boolean.parseBoolean(lifespanInputEnabledValue);
     tokenStateServiceStatusMap.put(LIFESPAN_INPUT_ENABLED_TEXT, lifespanInputEnabled.toString());
 
-    final String impersonationEnabledValue = context.getInitParameter(IMPERSONATION_ENABLED_PARAM);
-    final Boolean impersonationEnabled = impersonationEnabledValue == null ? Boolean.TRUE : Boolean.parseBoolean(impersonationEnabledValue);
-    tokenStateServiceStatusMap.put(IMPERSONATION_ENABLED_TEXT, impersonationEnabled.toString());
+    tokenStateServiceStatusMap.put(IMPERSONATION_ENABLED_TEXT, Boolean.toString(impersonationEnabled));
   }
 
   private void populateAllowedTokenStateBackendForTokenGenApp(final String actualTokenServiceName) {
@@ -711,7 +720,8 @@
     String userName = request.getUserPrincipal().getName();
     String createdBy = null;
     // checking the doAs user only makes sense if tokens are managed (this is where we store the userName information)
-    if (tokenStateService != null) {
+    // and if impersonation is enabled
+    if (impersonationEnabled && tokenStateService != null) {
       final String doAsUser = request.getParameter(QUERY_PARAMETER_DOAS);
       if (doAsUser != null && !doAsUser.equals(userName)) {
         try {
diff --git a/gateway-service-knoxtoken/src/test/java/org/apache/knox/gateway/service/knoxtoken/TokenServiceResourceTest.java b/gateway-service-knoxtoken/src/test/java/org/apache/knox/gateway/service/knoxtoken/TokenServiceResourceTest.java
index 6812b19..bf06269 100644
--- a/gateway-service-knoxtoken/src/test/java/org/apache/knox/gateway/service/knoxtoken/TokenServiceResourceTest.java
+++ b/gateway-service-knoxtoken/src/test/java/org/apache/knox/gateway/service/knoxtoken/TokenServiceResourceTest.java
@@ -170,6 +170,9 @@
     if (contextExpectations.containsKey(TokenResource.QUERY_PARAMETER_DOAS)) {
       EasyMock.expect(request.getParameter(TokenResource.QUERY_PARAMETER_DOAS)).andReturn(contextExpectations.get(TokenResource.QUERY_PARAMETER_DOAS)).anyTimes();
     }
+    if (contextExpectations.containsKey(TokenResource.IMPERSONATION_ENABLED_PARAM)) {
+      EasyMock.expect(request.getParameter(TokenResource.IMPERSONATION_ENABLED_PARAM)).andReturn(contextExpectations.get(TokenResource.IMPERSONATION_ENABLED_PARAM)).anyTimes();
+    }
     EasyMock.expect(request.getParameterNames()).andReturn(Collections.emptyEnumeration()).anyTimes();
 
     GatewayServices services = EasyMock.createNiceMock(GatewayServices.class);
@@ -1102,11 +1105,21 @@
 
   @Test
   public void testCreateImpersonatedToken() throws Exception {
+    testCreateImpersonatedToken(true);
+  }
+
+  @Test
+  public void testImpersonationDisabled() throws Exception {
+    testCreateImpersonatedToken(false);
+  }
+
+  private void testCreateImpersonatedToken(boolean enableImpersonation) throws Exception {
     final String impersonatedUser = "testUser";
     final Map<String, String> contextExpectations = new HashMap<>();
     contextExpectations.put(TokenResource.QUERY_PARAMETER_DOAS, impersonatedUser);
     contextExpectations.put(TokenResource.PROXYUSER_PREFIX + "." + USER_NAME + ".users", impersonatedUser);
     contextExpectations.put(TokenResource.PROXYUSER_PREFIX + "." + USER_NAME + ".hosts", "*");
+    contextExpectations.put(TokenResource.IMPERSONATION_ENABLED_PARAM, Boolean.toString(enableImpersonation));
     configureCommonExpectations(contextExpectations, Boolean.TRUE);
 
     final TokenResource tr = new TokenResource();
@@ -1116,13 +1129,18 @@
 
     tr.doGet();
 
-    final Response getKnoxTokensResponse = getUserTokensResponse(tr, true);
+    final Response getKnoxTokensResponse = getUserTokensResponse(tr, enableImpersonation);
     final Collection<LinkedHashMap<String, Object>> tokens = ((Map<String, Collection<LinkedHashMap<String, Object>>>) JsonUtils
         .getObjectFromJsonString(getKnoxTokensResponse.getEntity().toString())).get("tokens");
     final LinkedHashMap<String, Object> knoxToken = tokens.iterator().next();
     final Map<String, String> metadata = (Map<String, String>) knoxToken.get("metadata");
-    assertEquals(metadata.get("createdBy"), USER_NAME);
-    assertEquals(metadata.get("userName"), impersonatedUser);
+    if (enableImpersonation) {
+      assertEquals(metadata.get("createdBy"), USER_NAME);
+      assertEquals(metadata.get("userName"), impersonatedUser);
+    } else {
+      assertNull(metadata.get("createdBy"));
+      assertEquals(USER_NAME, metadata.get("userName"));
+    }
   }
 
   @Test