Spring Security - spring-mvc

Question

i'm developping a webapp using SS for role managing. when i try to log in as admin it works fine,but the problem is when i want to log in as user it does too, which something i don't want to be. any ideas plz
this is my security-cpntext.xml
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<!-- We will be defining all security related configurations in this file -->
<http pattern="/login" security="none" />
<http use-expressions="true" >
<intercept-url pattern="/login" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<intercept-url pattern="/login" access="permitAll" />
<intercept-url pattern="/index" access="hasRole('Admin')"/>
<form-login login-page="/login" default-target-url="/index" authentication-failure-url="/login"/> <!-- We will just use the built-in form login page in Spring -->
<access-denied-handler error-page="/login" />
<!-- <intercept-url pattern="/**" access="isAuthenticated()"/> --><!-- this means all URL in this app will be checked if user is authenticated -->
<logout logout-url="/logout" logout-success-url="/index"/> <!-- the logout url we will use in JSP -->
</http>
<beans:bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
<beans:property name="userDetailsService" ref="userDetailsService" ></beans:property>
</beans:bean>
<beans:bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager">
<beans:property name="providers">
<beans:list>
<beans:ref local="daoAuthenticationProvider"/>
</beans:list>
</beans:property>
</beans:bean>
<authentication-manager>
<authentication-provider user-service-ref="userDetailsService">
<password-encoder hash="md5"></password-encoder>
</authentication-provider>
</authentication-manager>

Answer 1

I can see two potential issues here that may be causing the problem.
1) You're specifying hasRole('Admin') for /index. If the role name is called Admin then you should specify hasRole('ROLE_Admin').
2) You've got duplication in your configuration. The <authentication-manager> tells Spring security to create a ProviderManager instance. So you've declared this, but you've also manually specified the ProviderManager as a bean instance duplicating what <authentication-manager> does. Remove the following:
<beans:bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
<beans:property name="userDetailsService" ref="userDetailsService" ></beans:property>
</beans:bean>
<beans:bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager">
<beans:property name="providers">
<beans:list>
<beans:ref local="daoAuthenticationProvider"/>
</beans:list>
</beans:property>
</beans:bean>
And leave:
<authentication-manager>
<authentication-provider user-service-ref="userDetailsService">
<password-encoder hash="md5"></password-encoder>
</authentication-provider>
</authentication-manager>
Try that and see what you get.