title: Spring Security two roles implementation
body: <p>I'm new to spring security method. I'm trying to implement two user's in my web application. (Admin Role &amp; User Role)
  I have two re-directions pages using thymeleaf for admin it should drop to /admin/** and for users it should be /user/**</p>
  
  <p>I've tried adding two spring security class using @order(1) and order(2) but still not working.. my aim is if the user logins and has roles in my security it should redirect to the correct pages.</p>
  
  <p>Please see my code below</p>
  
  <pre><code>spring.queries.users-query=select email, password, enabled from user where email=?
  spring.queries.roles-query=select u.email, r.role from user u inner join user_role ur on (u.id=ur.user_id) inner join role r on(ur.role_id=r.role_id) where u.email=?
  
      @Override
  protected void configure(AuthenticationManagerBuilder auth)
          throws Exception {
      auth.
          jdbcAuthentication()
              .usersByUsernameQuery(usersQuery)
              .authoritiesByUsernameQuery(rolesQuery)
              .dataSource(dataSource)
              .passwordEncoder(bCryptPasswordEncoder);
  }
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http.authorizeRequests()
          .antMatchers("/").permitAll()
          .antMatchers("/login").permitAll()
          .antMatchers("/register").permitAll()
          .antMatchers("/confirm").permitAll()
          .antMatchers("/forgotpassword").permitAll()
          .antMatchers("/criminal/getAllWantedCriminal").permitAll()
          .antMatchers("/criminal/viewCriminal").permitAll()
          .antMatchers("/admin/**").hasAuthority("ADMIN")
          .antMatchers("/user/**").hasAuthority("USER")
          .anyRequest()
          .authenticated().and().csrf().disable().formLogin()
          .loginPage("/login").failureUrl("/login?error=true")
          .defaultSuccessUrl("/admin/home")
          .usernameParameter("email")
          .passwordParameter("password")
          .and().logout()
          .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
          .logoutSuccessUrl("/").and().exceptionHandling()
          .accessDeniedPage("/access-denied");
  }
  </code></pre>