public class AuthenthicationServiceProvider extends AbstractUserDetailsAuthenticationProvider {


private StaffDao staffDao ;


@Override
protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
    // TODO Auto-generated method stub

}

@Override
protected UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
    UserDetails ad = null;
    try {
        ad= getUserDetailInfo(authentication.getPrincipal().toString(), authentication.getCredentials().toString());
    } catch (Exception e) {
        throw new CustomAuthenticationException(e.getMessage()) ;
    }
    return ad;

}

private AuthUserDetail getUserDetailInfo(final String login, final String password ) throws CustomAuthenticationException{
    Staff user = staffDao.getStaffByLogin(login, password);

    String role =  "ROLE_ADMIN";

    if (null == user ) {
        throw new CustomAuthenticationException("Invalid Username or password");
    }

    return new AuthUserDetail(user, role);
}

public StaffDao getStaffDao() {
    return staffDao;
}

public void setStaffDao(StaffDao staffDao) {
    this.staffDao = staffDao;
}

public class AuthUserDetail  implements UserDetails,Serializable  {

private static final long serialVersionUID = -3727430377858939077L;

private Staff staff;
private String role;
private Set<GrantedAuthority> authorities;

public AuthUserDetail(Staff pstaff, String pRole){
    setStaff(pstaff);
    setRole(pRole);
}

@Override
public Collection<GrantedAuthority> getAuthorities() {
     Collection<GrantedAuthority> a = new ArrayList<GrantedAuthority>(Arrays.asList(new GrantedAuthority(){
         public String getAuthority() {
             return role;
         }
   }));
   return a;
}

@Override
public String getPassword() {
    return this.staff.getPassword();
}

@Override
public String getUsername() {
    return this.staff.getLoginId();
}

@Override
public boolean isAccountNonExpired() {
    return true;
}

@Override
public boolean isAccountNonLocked() {
    return true;
}

@Override
public boolean isCredentialsNonExpired() {
    return true;
}

@Override
public boolean isEnabled() {

    return true;
}

public Staff getStaff() {
    return staff;
}

public void setStaff(Staff staff) {
    this.staff = staff;
}

public String getRole() {
    return role;
}

public void setRole(String role) {
    this.role = role;
}

@Override
public boolean equals(Object rhs) {
    if (!(rhs instanceof AuthUserDetail) || (rhs == null)) {
        return false;
    }

    AuthUserDetail user = (AuthUserDetail) rhs;

    // We rely on constructor to guarantee any User has non-null
    // authorities
    if (!getAuthorities().equals(user.getAuthorities())) {
        return false;
    }

    // We rely on constructor to guarantee non-null username and password
    return (this.getPassword().equals(user.getPassword()) && this.getUsername().equals(user.getUsername())
            && (this.isAccountNonExpired() == user.isAccountNonExpired())
            && (this.isAccountNonLocked() == user.isAccountNonLocked())
            && (this.isCredentialsNonExpired() == user.isCredentialsNonExpired())
            && (this.isEnabled() == user.isEnabled()));
}

@Override
public int hashCode() {
    int code = 9792;

    for (GrantedAuthority authority : getAuthorities()) {
        code = code * (authority.hashCode() % 7);
    }

    if (this.getPassword() != null) {
        code = code * (this.getPassword().hashCode() % 7);
    }

    if (this.getUsername() != null) {
        code = code * (this.getUsername().hashCode() % 7);
    }

    if (this.isAccountNonExpired()) {
        code = code * -2;
    }

    if (this.isAccountNonLocked()) {
        code = code * -3;
    }

    if (this.isCredentialsNonExpired()) {
        code = code * -5;
    }

    if (this.isEnabled()) {
        code = code * -7;
    }

    return code;
}

@Override
public String toString() {
    StringBuilder sb = new StringBuilder();
    sb.append(super.toString()).append(": ");
    sb.append("Username: ").append(this.getUsername()).append("; ");
    sb.append("Password: [PROTECTED]; ");
    sb.append("Enabled: ").append(this.isEnabled()).append("; ");
    sb.append("AccountNonExpired: ").append(this.isAccountNonExpired()).append("; ");
    sb.append("credentialsNonExpired: ").append(this.isCredentialsNonExpired()).append("; ");
    sb.append("AccountNonLocked: ").append(this.isAccountNonLocked()).append("; ");

    if (!authorities.isEmpty()) {
        sb.append("Granted Authorities: ");

        boolean first = true;
        for (GrantedAuthority auth : authorities) {
            if (!first) {
                sb.append(",");
            }
            first = false;

            sb.append(auth);
        }
    } else {
        sb.append("Not granted any authorities");
    }

    return sb.toString();
}

}

<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
                     http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                    http://www.springframework.org/schema/security
                     http://www.springframework.org/schema/security/spring-security-3.0.xsd">

<global-method-security pre-post-annotations="enabled" secured-annotations="enabled" jsr250-annotations="enabled"  />

<http auto-config="true"    access-denied-page="/login.xhtml">

    <intercept-url pattern="/logout*" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <intercept-url pattern="/login*" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <intercept-url pattern="/error/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <intercept-url pattern="/css/**" filters="none"  />
    <intercept-url pattern="/images/**" filters="none" />
    <intercept-url pattern="/js/**" filters="none" />
    <intercept-url pattern="/a4j/**" filters="none" />

    <intercept-url pattern="/common/**" access="ROLE_ADMIN,ROLE_USER" />
    <intercept-url pattern="/customers/**" access="ROLE_ADMIN,ROLE_USER" />
    <intercept-url pattern="/journal/**" access="ROLE_ADMIN,ROLE_USER" />
    <intercept-url pattern="/masterCustomer/**" access="ROLE_ADMIN,ROLE_USER" />
    <intercept-url pattern="/report/**" access="ROLE_ADMIN,ROLE_USER" />
    <intercept-url pattern="/setting/**" access="ROLE_ADMIN,ROLE_USER" />
    <intercept-url pattern="/staffs/**" access="ROLE_ADMIN,ROLE_USER" />
    <intercept-url pattern="/templates/**" access="ROLE_ADMIN,ROLE_USER" />
    <intercept-url pattern="/transactions/**" access="ROLE_ADMIN,ROLE_USER" />
    <intercept-url pattern="/winloses/**" access="ROLE_ADMIN,ROLE_USER" />
    <intercept-url pattern="/**" access="ROLE_ADMIN,ROLE_USER" />

    <form-login
        login-processing-url="/j_spring_security_check"
        login-page="/login.xhtml"
        default-target-url="/transactions/index.xhtml"
        authentication-failure-url="/login.xhtml?error=true" always-use-default-target="true"  />


    <session-management   session-authentication-error-url="/login.xhtml?expired=2" invalid-session-url="/login.xhtml?expired=1" session-fixation-protection="newSession">
           <concurrency-control session-registry-ref="sessionRegistry"  max-sessions="1" error-if-maximum-exceeded="true" expired-url="/login.xhtml?errorMessage=The session is expired due to another user logging in with your user name and password."/>
    </session-management>

</http>

<authentication-manager >
    <authentication-provider  ref="authenthicationServiceProvider" />
</authentication-manager>

<beans:bean id="authenthicationServiceProvider" class="com.cboclub.csmweb.service.AuthenthicationServiceProvider">
    <beans:property name="staffDao" ref="staffDao" />
</beans:bean>

<beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" />


</beans:beans>