<http>
		<intercept-url pattern="/**" access="hasRole('USER')" />
		<form-login />
		<logout />
	</http>

2.添加用戶：

	<authentication-manager>
	<authentication-provider>
		<user-service>
		<user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN" />
		<user name="bob" password="bobspassword" authorities="ROLE_USER" />
		</user-service>
	</authentication-provider>
	</authentication-manager>

Spring Security xml：

<!-- 	<http /> -->
	<http>
		<intercept-url pattern="/**" access="hasRole('ADMIN')" />
		<form-login />
		<logout />
	</http>

<!-- 	<user-service> -->
<!-- 		<user name="user" password="password" authorities="ROLE_USER" /> -->
<!-- 	</user-service> -->
	<authentication-manager>
		<authentication-provider>
			<user-service>
			<user name="user" password="password" authorities="ROLE_USER, ROLE_ADMIN" />
			<user name="bob" password="bobspassword" authorities="ROLE_USER" />
			</user-service>
		</authentication-provider>
	</authentication-manager>

Spring Security 簡單的用戶權限判斷