title: use existing domain classes with Spring Security plugin
body: <p>I'm trying to convert a Stripes web app to Grails. The Stripes app uses Spring Security, but I would like the Grails app to use the Spring Security Grails plugin. </p>
  
  <p>The app already has <code>User</code> and <code>Role</code> (Java) classes that I need to reuse, i.e. I cannot use the Grails domain classes that the <a href="http://grails-plugins.github.com/grails-spring-security-core/docs/manual/ref/Scripts/s2-quickstart.html" rel="nofollow noreferrer">s2-quickstart</a> script generates.</p>
  
  <p>The Spring Security plugin docs describe how to use an existing <code>User</code> domain class. The steps seem to be:</p>
  
  <ol>
  <li>define a <code>UserDetails</code> implementation that reads from the existing <code>User</code> domain class</li>
  <li>define a custom <code>UserDetailsService</code> implementation that returns instances of (1)</li>
  <li>register an instance of (2) as a Spring bean named <code>userDetailsService</code>.</li>
  </ol>
  
  <p>However the docs don't provide any information about how to use an existing <code>Role</code> class and the class that represents the many-to-many relationship between <code>User</code> and <code>Role</code>.</p>
  
  <p>What other steps are necessary to use existing <code>Role</code>, <code>User</code>, and <code>UserRole</code> classes with the Grails Spring Security plugin? Is there any reason for me to run the <a href="http://grails-plugins.github.com/grails-spring-security-core/docs/manual/ref/Scripts/s2-quickstart.html" rel="nofollow noreferrer">s2-quickstart</a> script if I don't want to generate any domain classes?</p>
  
  <h2>Follow-Up Questions to Burt's Answer</h2>
  
  <blockquote>
    <p>In the end, what you need is a new <code>GrailsUser</code></p>
  </blockquote>
  
  <p>Presumably <code>GrailsUser</code> here refers to the custom <code>UserDetails</code> implementation? In my case I'll probably just implement the interface directly. Does something like this seem reasonable?</p>
  
  <pre><code>class UserAdapter implements UserDetails {
    private String password  
    private Collection&lt;GrantedAuthority&gt; springRoles
  
    UserAdapter(User user) {
      this.password = user.password
  
      Collection&lt;Role&gt; roles = // load legacy Role objects
      this.springRoles = roles.collect { new GrantedAuthorityImpl(it.authority) }
    }      
  
    // If using password hashing, presumably this is the hashed password?
    String getPassword() {
      password  
    }
  
    ///////// other UserDetails methods omitted
  
    Collection&lt;GrantedAuthority&gt; getAuthorities() {
      springRoles
    }
  }
  </code></pre>
  
  <p>I'm not storing the whole <code>User</code> object within <code>UserAdapter</code> because of your warning about storing a potentially large object in the HTTP session.</p>
  
  <blockquote>
    <p>what you need is.....and a List of GrantedAuthority instances (and the id if it's a GrailsUser)</p>
  </blockquote>
  
  <p>If I use my own <code>UserDetails</code> implementation as above, then presumably I can ignore this comment about providing an <code>id</code>?</p>
  
  <p>Finally, if I follow the approach outlined above, should I set <a href="https://stackoverflow.com/questions/6899566/use-existing-domain-classes-with-spring-security-plugin/6913928#6913928">these properties</a> in <code>Config.groovy</code> and do I need to run the <code>s2-quickstart</code> script (or any others)?</p>