UserService.IsActive Impersonation Redirect Loop

I have implemented IsActive inside my custom user service and one of the steps that I do in that method is: check if the user has any roles for the requested client. If user has no roles IsActive will retu false. This works well for regular scenarios. However once I implemented impersonation workflow, I started to get infinite redirects between login page and authorize endpoint.

I can implement the same IsActive check in my impersonate logic, but is there something else that I'm missing? It seems to me that I need to add something to IndentityServer so that it shows an error/not_authorized page, but I can't figure out where.

Implementation Details:

Impersonation is impelemented by retuning full AuthenticateResult from PreAuthenticateAsync based on custom acr_values.

var impersonate = context.SignInMessage.AcrValues.FirstOrDefault(x => x.StartsWith("impersonate"));

if (!string.IsNullOrWhiteSpace(impersonate))
{
    var adminUserName = _owinContext.Authentication.User.FindFirst(Constants.ClaimTypes.Subject).Value;
    var adminUser = _service.GetUser(adminUserName);
    bool isAllowedImpersonation = true; //TODO:

    var impersonateSplit = impersonate.Split(':');
    if (impersonateSplit.Length != 2 || !isAloowedImpersonation)
    {
        context.AuthenticateResult = new AuthenticateResult("Invalid attempt to impersonate user");
    }

    var impesonateUserName = impersonateSplit[1];
    var impersonateUser = _service.GetUser(impesonateUserName);

    context.AuthenticateResult =
        new AuthenticateResult(
            impersonateUser.Useame,
            impersonateUser.Name,
            claims: new[] { new Claim(Constants.ClaimTypes.ClientId, context.SignInMessage.ClientId) },
            identityProvider: Constants.BuiltInIdentityProvider,
            authenticationMethod: Constants.AuthenticationMethods.Password);
}

Logic inside IsActive:

var user = _service.GetUser(context.Subject.GetSubjectId());

if (user == null || !user.IsActive)
    retu Task.FromResult(false);

var application = _service.GetApplicationByCode(context.Subject.GetClientId());

context.IsActive = _service.UserHasAccessTo(user, application.Code);