Spring Secuirty file to configure url-patterns, login, logout and error page. Configure handler for successful and unsuccessful login. Authentication manager and provider.

spring-security.xml

<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans	http://www.springframework.org/schema/beans/spring-beans-4.2.xsd
	http://www.springframework.org/schema/security	http://www.springframework.org/schema/security/spring-security-4.0.xsd">

	<http auto-config="true">
		<intercept-url pattern="/login" access="permitAll" />
		<intercept-url pattern="/admin**" access="hasRole('ROLE_ADMIN')" />
		<intercept-url pattern="/**" access="hasRole('ROLE_USER')" />

		<form-login login-page="/login"
			authentication-success-handler-ref="customAuthenticationSuccessHandler"
			authentication-failure-handler-ref="customAuthenticationFailureHandler" />
		<access-denied-handler error-page="/accessDenied" />
		<logout logout-url="/logout" logout-success-url="/login?logout" />
	</http>

	<authentication-manager alias="authenticationManager">
		<authentication-provider user-service-ref="userService"/>
	</authentication-manager>

</beans:beans>

Refer Spring Security 4 with Hibernate for complete example.