spring-security/samples/xml/servletapi/src/main/resources/applicationContext-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
		 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
		 xmlns="http://www.springframework.org/schema/security"
		 xsi:schemaLocation="http://www.springframework.org/schema/security https://www.springframework.org/schema/security/spring-security.xsd
	http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans.xsd">

	<http auto-config="true">
		<intercept-url pattern="/**" access="permitAll"/>
	</http>

	<authentication-manager>
		<authentication-provider>
			<user-service>
				<user name="user" password="password" authorities="ROLE_USER" />
				<user name="admin" password="password" authorities="ROLE_USER,ROLE_ADMIN"/>
			</user-service>
		</authentication-provider>
	</authentication-manager>
</b:beans>