Ok guys, I summarized the complete approach as I read through, and I think it is a simpler and possibly more elegant approach than the originally suggested solution. (Or at least easier to understand). So I have compiled the steps I'm taking below and will report back before long with a note on my progress, here are my notes which as of now encompass three steps: Directions for the assuming a delegate subject with Jsecurity: 1.Create a class that assumes a delegate subject that is already set in the session. (The assumed identity would be set in a controller) class AssumingDelegatingSubject extends DelegatingSubject { public Object getPrincipal() { return this.session?.assumedIdentity ?: super.getPrincipal() } }

2. Create a subclass of DefaultSecurityManager that returns the custom subject. Per, the previous note, from Les Hazlewood. The SecurityManager implementation would need to be subclassed to return instances of your custom DelegatingSubject subclass. You do that by overridding this overloaded method: http://www.jsecurity.org/api/org/jsecurity/mgt/DefaultSecurityManager.html#createSubject(org.jsecurity.subject.PrincipalCollection,%20org.jsecurity.session.Session,%20boolean,%20java.net.InetAddress) Your overridden method would return an instance of your custom DelegatingSubject subclass. "

3. Register the custom security manager in resources.groovy or resources.xml as jsecSecurityManager On Mon, Jan 12, 2009 at 4:03 PM, Peter Ledbrook <pet...@cacoethes.co.uk> wrote: