title: How to enable Spring security?
body: <p>I wonder why my Spring security is not working. I've got this spring-security.xml</p>
  
  <pre><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
               xmlns:beans="http://www.springframework.org/schema/beans"
               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xsi:schemaLocation="http://www.springframework.org/schema/beans
             http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
             http://www.springframework.org/schema/security
             http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
       &lt;http auto-config='true'&gt;
          &lt;intercept-url pattern="/**" access="ROLE_USER" /&gt;
          &lt;port-mappings&gt;
              &lt;port-mapping http="8088" https="9443"/&gt;
          &lt;/port-mappings&gt;
      &lt;/http&gt;
  
      &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;
              &lt;user-service&gt;
                  &lt;user name="admin" password="password2" authorities="ROLE_USER" /&gt;
                  &lt;user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN" /&gt;
                  &lt;user name="bob" password="bobspassword" authorities="ROLE_USER" /&gt;
              &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>Then I got this web.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;
              /WEB-INF/spring/admin-servlet-common.xml
              /WEB-INF/spring/admin-servlet-controller.xml
              /WEB-INF/spring/admin-servlet-security.xml
              /WEB-INF/spring/admin-servlet-service.xml
              /WEB-INF/spring-security.xml
              classpath:ses-service.xml
          &lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;log4jConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;/WEB-INF/log4j.xml&lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.util.Log4jConfigListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
  
      &lt;!-- Reads request input using UTF-8 encoding --&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;characterEncodingFilter&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.CharacterEncodingFilter&lt;/filter-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;encoding&lt;/param-name&gt;
              &lt;param-value&gt;UTF-8&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;forceEncoding&lt;/param-name&gt;
              &lt;param-value&gt;true&lt;/param-value&gt;
          &lt;/init-param&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;characterEncodingFilter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
      &lt;!-- Enables clean URLs with JSP views e.g. /welcome instead of /app/welcome --&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;UrlRewriteFilter&lt;/filter-name&gt;
          &lt;filter-class&gt;org.tuckey.web.filters.urlrewrite.UrlRewriteFilter&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;UrlRewriteFilter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
      &lt;!-- Spring Security --&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
      &lt;!-- Handles all requests into the application --&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;ses&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;2&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;ses&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/app/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>But it neither gives an error message nor enables security. There is no change is my webapp and I can still browse the pages e.g. <code>http://localhost:8088/admin/login</code> and <code>http://localhost:8088/admin/menu</code> . This project is the admin part of a web app and I'm enabling security for the admin web. What can be done? My own login page that I'd like to use is <code>http://localhost:8088/admin/login</code> and I'd like to secure the rest of the /admin* pages for the admin role. </p>