<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:security="http://www.springframework.org/schema/security"
       xmlns:util="http://www.springframework.org/schema/util"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="
           http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
           http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd
           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">

    <security:http auto-config="true" use-expressions="true">
        <security:form-login login-page="/page/login.html"
                             authentication-failure-url="/page/login.html"
                             default-target-url="/page/passingscore/passingscore.html" />

        <security:intercept-url pattern="/j_spring_security_check" access="permitAll"/>

        <security:intercept-url pattern="/*" access="permitAll" />
        <security:intercept-url pattern="/page/*" access="permitAll" />

		... поскипано ...

        <security:intercept-url pattern="/service/**"
                                access="hasRole('ROLE_ADMIN', ......)"/>

        <security:intercept-url pattern="/static/**"
                                access="permitAll" />

    </security:http>

    <bean id="UserAuthService" class="com.project.service.admin.UserAuthService" />

    <security:authentication-manager alias="authenticationManager">
        <security:authentication-provider user-service-ref="UserAuthService" />
    </security:authentication-manager>

</beans>