Spring Security authentication decision - spring-mvc

Question

In my Spring Security I have an issue. When I access url's like /admin, /client or even /admin/addUser.jsp it returns me to a login page (as it necessary) but when I access the url like /addUser (which mapped to Spring MVC controller) it returns me a page in any case even if user is not authenticated. What configuration I need to add/remove/modify in order to Security performs everything well.
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
<security:http auto-config="true" use-expressions="true"> <!--access-decision-manager-ref="accessDecisionManager"-->
<security:intercept-url pattern="/login" access="permitAll"/>
<security:intercept-url pattern="/admin*/**" access="hasRole('ROLE_ADMIN')"/>
<security:intercept-url pattern="/client*/**" access="hasRole('ROLE_USER')"/>
<security:form-login login-page="/login" default-target-url="/index" authentication-failure-url="/loginFail"
authentication-success-handler-ref="redirectRoleStrategy"/>
<security:logout logout-success-url="/logout" invalidate-session="true"/>
<security:access-denied-handler error-page="/403"/>
</security:http>
<bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
<property name="userDetailsService" ref="userDetailsService"/>
</bean>
<bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager">
<property name="providers">
<list>
<ref local="daoAuthenticationProvider"/>
</list>
</property>
</bean>
<security:authentication-manager>
<security:authentication-provider user-service-ref="userDetailsService"/>
</security:authentication-manager>
<bean id="redirectRoleStrategy" class="com.payment.system.util.RoleBasedAuthenticationSuccessHandler">
<property name="roleUrlMap">
<map>
<entry key="ROLE_ADMIN" value="/admin"/>
<entry key="ROLE_USER" value="/client"/>
</map>
</property>
</bean>
</beans>
P.S.: By the way, my IDEA strikes-through me a <property name="providers"> line reporting me that this property is deprecated. To what property I should replace this?
Thank you!

Answer 1

Just add
<security:intercept-url pattern="/**" access="isFullyAuthenticated()" />
after all yours intercept-url tags (I mean it must be the last one)
For PS question: as explained in javadoc just use use constructor injection (via constructor-arg tag).

Answer 2

When you will add the configuration suggested by Maksym it will solve your authentication problem. But it will NOT solve your authorization problem. A user with the role ROLE_USER will be able to access to /addUser.
Two solutions:
1) Move all URLs that should be accessed by admin under to /admin**. This solution may be complicated.
2) Replace configuration suggested my Maxim by the following configuration:
<security:intercept-url pattern="/**" access="hasRole('ROLE_ADMIN')" />
Please not that in this case the user with the role ROLE_USER will be able to access only to URLs /client*/**
Please tell me if you need any additional help.
Best regards,
Michael
P.S. I recommend to define all beans via namespace as explained here: http://static.springsource.org/spring-security/site/docs/3.0.x/reference/ns-config.html
It should eliminate warnings.