如何使用Spring Security在Spring xml中为一个特殊的URL一起定义ROLE_USER，ROLE_ADMIN IN？

Question

I am Using spring security for login and logout with multiple users with different rolls I have set the two uers to acces the dba url for admin and dba but I access the Url

http://localhost:8080/secu_fin_ano/dba

It redirects to the default spring login form after entering the admin uername and password of the admin its redirects page to the /access-denied that i have defined in security.xml

code for security.xml:

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
     http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
    http://www.springframework.org/schema/security 
    http://www.springframework.org/schema/security/spring-security-4.0.xsd">


    <http auto-config="true" >
        <intercept-url pattern="/" access="permitAll" />
        <intercept-url pattern="/home" access="permitAll" />
        <intercept-url pattern="/admin**" access="hasRole('ADMIN')" />
        <intercept-url pattern="/dba**" access="hasRole('ADMIN') and hasRole('DBA')" />
        <access-denied-handler error-page="/Access_Denied" />
        <form-login  authentication-failure-url="/Access_Denied" />
    </http>

    <authentication-manager >
        <authentication-provider>
            <user-service>
                <user name="bill"  password="abc123"  authorities="ROLE_USER" />
                <user name="admin" password="root123" authorities="ROLE_ADMIN" />
                <user name="dba"   password="root123" authorities="ROLE_ADMIN,ROLE_DBA" />
            </user-service>
        </authentication-provider>
    </authentication-manager>


</beans:beans>

Answer 1

i have solved my problem by using

 <intercept-url pattern="/dba**" access="hasAnyRole('ADMIN','DBA')" />

in security.xml instead of

<intercept-url pattern="/dba**" access="hasRole('ADMIN') and hasRole('DBA')" />