Grails Spring Security Core expired-credential redirect after authentication

Goal

Configure the Grails Spring Security Core plugin so that a user account with passwordExpired = true is sent to an application-defined password-change controller immediately after authentication, rather than to the default target URL.

Constraints

The core plugin does not supply a mandatory post-login redirect or password-change controller. Expired credentials surface as CredentialsExpiredException during authentication, but the recovery path and any temporary role relaxation for the reset controller must be defined by the application. This assumes a database-backed user lookup and Grails 5 or 6 with Spring Security Core 5.x; LDAP or custom providers may behave differently.

Questions

• Which authentication event or failure handler is the correct interception point for CredentialsExpiredException after a successful login?
• Which request-map or annotation-based access rules should scope the password-change controller without granting unrelated authorities?
• Should expired-credential users be blocked from all secured URLs until the password is reset, or only from non-reset endpoints?