title: Spring security - how come I can only access pages as ROLE_ADMIN and not ROLE_USER?
body: <p>In my application, I have a <code>SecurityConfiguration</code> class that has the following method:</p>
  
  <pre><code>protected void configure(HttpSecurity http) throws Exception {
      CharacterEncodingFilter filter = new CharacterEncodingFilter();
      http.addFilterBefore(filter,CsrfFilter.class);
  
      http
          .formLogin()
              .loginPage("/login")
              .usernameParameter("ssoId")
              .passwordParameter("password")
              .and()
  
          .authorizeRequests()
  
              // I admit that this section needs some work
              .antMatchers("/", "/home/**", "/alert/*", "/scheduler/*", "/agent/*", "/ftp/*", "/smtp/*", "/sql/*").access("hasRole('USER')")
              .antMatchers("/benefit/transport/*", "/contract/*").access("hasRole('ADMIN')")
              .antMatchers("/", "/home/*", "/alert/*", "/scheduler/*", "/agent/*", "/ftp/*", "/smtp/*", "/sql/*").access("hasRole('ADMIN')")
              .antMatchers("/benefit/transport/*", "/contract/*").access("hasRole('ADMIN')")
              .antMatchers("/admin/**").access("hasRole('ADMIN')")
              .antMatchers("/db/**").access("hasRole('ADMIN') and hasRole('DBA')")
  
              .and()
                  .rememberMe().rememberMeParameter("remember-me").tokenRepository(persistentTokenRepository()).tokenValiditySeconds(86400)
              .and()
                  .csrf()
              .and()
                  .exceptionHandling().accessDeniedPage("/accessDenied");
  }
  </code></pre>
  
  <p>But as stated on the question, I my user has the ROLE_ADMIN privilege, access is normal throughout the application. But if he has only ROLE_USER, no pages are displayed.</p>
  
  <p>What am I not seeing here?</p>