spring-security/samples/preauth-xml/src/main/webapp/WEB-INF/applicationContext-security.xml

<?xml version="1.0" encoding="UTF-8"?>

<!--
  - Sample namespace-based configuration
  -
  -->

<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:sec="http://www.springframework.org/schema/security"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
						http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

	<sec:http>
		<sec:intercept-url pattern="/secure/extreme/**" access="hasRole('ROLE_SUPERVISOR')"/>
		<sec:intercept-url pattern="/secure/**" access="hasRole('ROLE_USER')"/>
		<sec:intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>

		<sec:jee mappable-roles="ROLE_USER,ROLE_SUPERVISOR" />

		<sec:logout />
	</sec:http>

	<sec:authentication-manager />

</beans>