applicationContext-security.xml

<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"
   xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
       http://www.springframework.org/schema/security
       http://www.springframework.org/schema/security/spring-security-3.0.xsd">

   <http auto-config="true" access-denied-page="/">
      <intercept-url pattern="/pages/**"
         access="ROLE_SUPERVISOR,ROLE_USER,ROLE_TELLER" />
      <intercept-url pattern="/faces/protected**"
         access="ROLE_SUPERVISOR,ROLE_USER,ROLE_TELLER" />
      <intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
      <form-login login-page="/login.jsf" 
          authentication-failure-url = "/login.jsf?login_error=1" />
   </http>

<authentication-manager>
   <authentication-provider user-service-ref="userController">
      <password-encoder hash="sha" />
   </authentication-provider>
</authentication-manager>
</beans:beans>