@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true) 
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    @Qualifier("userDetailsService")
    private UserDetailsService userDetailsService;

    @Autowired
    private RestAuthenticationEntryPoint authenticationEntryPoint;
    @Autowired
    private RestAuthenticationSuccessHandler restAuthenticationSuccessHandler;
    @Autowired
    private RestAuthenticationAccessDeniedHandler restAuthenticationAccessDeniedHandler;


    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService); 
    }

    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .exceptionHandling()
                .authenticationEntryPoint(authenticationEntryPoint)
                .and()
                .authorizeRequests()
                .antMatchers("/admin/**").authenticated()
                .and()
                .formLogin()
                .successHandler(restAuthenticationSuccessHandler)
                .failureHandler(restAuthenticationAccessDeniedHandler)
                .and()
                .logout();
    } 
}

@Component
public class RestAuthenticationEntryPoint implements AuthenticationEntryPoint {

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws 

IOException {

        response.getWriter().print("{\"error\":\"Unauthorized!\"}");
        response.getWriter().flush();
    }
}

@Component
public class RestAuthenticationAccessDeniedHandler extends SimpleUrlAuthenticationFailureHandler {
    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException e) throws IOException, 

ServletException {
        response.getWriter().print("{\"error\":\"Access denied!\"}");
    }

{"error":"Unauthorized!"} 

@Controller
@RequestMapping("/auth")
public class AuthController {

@Autowired
private UserService userService;

@RequestMapping(value = "/login", method = {RequestMethod.GET, RequestMethod.POST})
    @ResponseBody
    public LoginResponse login(@RequestBody LoginRequest loginRequest, HttpServletRequest request){
     
}
......

LoginRequest {
    private LoginUserInfo loginUserInfo;
...

LoginUserInfo {
    private Long id;
    private String login;
    private String password;
    private UserType userType;

MyUser myUser = userService.findByLoginAndPassword(loginRequest.getLoginUserInfo().getLogin(), loginRequest.getLoginUserInfo().getPassword());