how to use switched user spring security in grails to override user permissions -

i'm trying build administrative tools user gsp's without building entire administration controller , pages.

my application has user's , administrators. user creates account, administrator approves account before user can perform functions. admin uses switchuser feature review user's account before approving account.

instead of writing code admin have go , user, find record, , update account approved, want add 'approve' button on 1 of user account pages visible admin in switched user role. issue 'approve' action can't executed user's permissions admin has switched to, otherwise user activate own account.

this gsp looks like:

my.gsp:

<sec:ifswitched>     <p><g:link controller='charge' action='activateprofile'>approve profile</g:link> - profile become live in system.</p> </sec:ifswitched> 

i'm using @secured annotations in controller

what works doesn't seem right:

@secured("permitall() , isauthenticated()") def activateprofile() {    springsecurityutils.isswitcheduser() {       //activate profile    }    else {       //not allowed unless switched user    } } 

what i'd work doesn't exist because there no isswitcheduser() annotation:

@secured("isauthenticated() , (hasanyrole('role_admin', 'role_switched_user') or isswitcheduser()) def activateprofile() {    //update database , make user's profile active } 

and of course doesn't work because switched user, switched account doesn't have either of these roles, page not authorized error occurs:

@secured("isauthenticated() , (hasanyrole('role_admin', 'role_switched_user')) def activateprofile() {    springsecurityutils.isswitcheduser() {       //activate profile    }    else {       //not allowed unless switched user    } } 

am stuck using permitall , checking in action permission? works , secure doesn't feel right.

you can using 1 of following 2 ways:

custom permissionevaluator

you can use haspermission() methods within security annotations , create custom permissionevaluator. within code looks this:

@preauthorize("haspermission(#myobject, 'update')") public void updatesomething(myobject) {   .. } 

inside permissionevaluator implementation can place check switched user.

service calls in security annotations

inside security expressions can reference beans prefixing bean names @.

for example:

@preauthorize("@mysecurityservice.isswitcheduser() or ...") public void dosomething(myobject) {   .. } 

more details: both methods require bit of setup. time ago wrote more detailed answer these 2 methods. can find here: grails custom security evaluator