Daniel, did you succeed? What did you do?

Peter, I hope your offer is valid for me, too? ;-)

From the aforementioned mail discussion, I liked Les' approach with the wrapper for the Subject interface. To cut it short: You store a second principal in the session and if that is set, return it instead of the original one.

I think this code snippet should already do the trick:

class AssumingDelegatingSubject extends DelegatingSubject { public Object getPrincipal() { return this.session?.assumedIdentity ?: super.getPrincipal() } }

After looking through JSecurity API and plugin code for quite a while now, I still have no Idea where to put this little class and what else to change, so that it will be picked up and used instead of the default class (I think that's DelegatingSubject).

Thanks for any hint.

Cheers, DJ

2008/12/31 Peter Ledbrook <p.le...@cacoethes.co.uk>: