<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:security="http://www.springframework.org/schema/security"
 xsi:schemaLocation="http://www.springframework.org/schema/beans
      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
   http://www.springframework.org/schema/security
   http://www.springframework.org/schema/security/spring-security-3.0.xsd">
  
 <!-- This is where we configure Spring-Security  -->
 <security:http auto-config="true" use-expressions="true" access-denied-page="/krams/auth/denied" >
  
  <security:intercept-url pattern="/krams/auth/login" access="permitAll"/>
  <security:intercept-url pattern="/krams/main/admin" access="hasRole('ROLE_ADMIN')"/>
  <security:intercept-url pattern="/krams/main/common" access="hasRole('ROLE_USER')"/>
   
  <security:form-login
    login-page="/krams/auth/login"
    authentication-failure-url="/krams/auth/login?error=true"
    default-target-url="/krams/main/common"/>
    
  <security:logout
    invalidate-session="true"
    logout-success-url="/krams/auth/login"
    logout-url="/krams/auth/logout"/>
  
 </security:http>
  
 <!-- Declare an authentication-manager to use a custom userDetailsService -->
 <security:authentication-manager>
         <security:authentication-provider user-service-ref="customUserDetailsService">
           <security:password-encoder ref="passwordEncoder"/>
         </security:authentication-provider>
 </security:authentication-manager>
  
 <!-- Use a Md5 encoder since the user's passwords are stored as Md5 in the database -->
 <bean class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" id="passwordEncoder"/>
 
 <!-- A custom service where Spring will retrieve users and their corresponding access levels  -->
 <bean id="customUserDetailsService" class="org.krams.tutorial.service.CustomUserDetailsService"/>
  
</beans>

<security:authentication-provider user-service-ref="тут">

@Service
public class AccountServiceImpl implements AccountService, UserDetailsService{

 <!-- Declare an authentication-manager to use a custom userDetailsService -->
 <security:authentication-manager>
         <security:authentication-provider user-service-ref="AccountServiceImpl">
           <security:password-encoder ref="passwordEncoder"/>
         </security:authentication-provider>
 </security:authentication-manager>
  
 <!-- Use a Md5 encoder since the user's passwords are stored as Md5 in the database -->
 <bean class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" id="passwordEncoder"/>

         <security:authentication-provider user-service-ref="AccountServiceImpl">
           <security:password-encoder ref="passwordEncoder"/>
         </security:authentication-provider>

private PasswordEncoder encoder = new Md5PasswordEncoder();

u.setPassword(encoder.encodePassword(plainTextPassword, username));

<security:password-encoder ref="passwordEncoder"/>

private PasswordEncoder encoder = new Md5PasswordEncoder();

u.setPassword(encoder.encodePassword(plainTextPassword, username));

и далее сохранять в DB

<security:intercept-url pattern="/krams/main/common" access="hasRole('ROLE_USER')"/>

	public UserDetails loadUserByUsername(String username)
			throws UsernameNotFoundException {

	public UserDetails loadUserByUsername(String username)
			throws UsernameNotFoundException {