Another thing to check is that can_impersonate is set up as a string type, not a boolean. If you set it up as a boolean and set the value to 1 (instead of "1"), you'll get an error and the policy won't continue to the next screen after the initial login screen.