spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
	xmlns:p="http://www.springframework.org/schema/p" 
	xmlns:util="http://www.springframework.org/schema/util"
	xsi:schemaLocation="http://www.springframework.org/schema/beans 
		http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
		http://www.springframework.org/schema/security 
		http://www.springframework.org/schema/security/spring-security-3.1.xsd
		http://www.springframework.org/schema/util 
		http://www.springframework.org/schema/util/spring-util-3.1.xsd">

	<http pattern="/resources" security="none" />
	
	<http auto-config="true"  use-expressions="true">
		<intercept-url pattern="/login" access="permitAll"/>
		<intercept-url pattern="/logout" access="permitAll"/>
		<intercept-url pattern="/denied" access="hasRole('ROLE_USER')"/>
		<intercept-url pattern="/" access="hasRole('ROLE_USER')"/>
		<intercept-url pattern="/user" access="hasRole('ROLE_USER')"/>
		<intercept-url pattern="/admin" access="hasRole('ROLE_ADMIN')"/>
		
		<form-login login-page="/login" 
			authentication-failure-url="/login/failure" 
			default-target-url="/"/>
		
		<access-denied-handler error-page="/denied"/>
		
		<logout invalidate-session="true" 
			logout-success-url="/logout/success" 
			logout-url="/logout"/>
	</http>
	
	<authentication-manager>
	        <authentication-provider user-service-ref="customUserDetailsService">
	        		<password-encoder hash="md5"/>
	        </authentication-provider>
	</authentication-manager>
</beans:beans>