In my Spring MVC web application, there are certain areas accessible only to users with sufficient privileges. Rather than just have a "access denied" message, I need to be able to allow users to log in as a different user in order to use these pages (sort of like an override).

How can I do this with Spring Security?

Here's the flow I am looking to have, with a bit more detail:

  1. User A comes in to page X from external application and is authenticated via headers
  2. User A does not have permission to use page X, and so is taken to the login screen with a message indicating that they must log in as a user with sufficient privilages to use this page
  3. User B logs in, and has sufficient privilages, and is taken to page X.


Note: Page X has a big, long query string that needs to be preserved.

How can I do this with Spring Security?