@Service
@Qualifier("customUserDetailsService")
public class CustomUserDetailsService implements UserDetailsService {

@Autowired
private UserRepository userRepository;

@Transactional(readOnly = true)
@Override
public UserDetails loadUserByUsername(final String username) throws UsernameNotFoundException {
    System.err.println(username);
    User user = userRepository.findByEmail(username);
    List<GrantedAuthority> authorities = buildUserAuthority(user.getRoles());

    return buildUserForAuthentication(user, authorities);

}

private org.springframework.security.core.userdetails.User buildUserForAuthentication(User user,
        List<GrantedAuthority> authorities) {
    return new org.springframework.security.core.userdetails.User(user.getEmail(), user.getPassword(), authorities);
}

private List<GrantedAuthority> buildUserAuthority(List<Role> userRoles) {

    Set<GrantedAuthority> setAuths = new HashSet<GrantedAuthority>();

    // Build user's authorities
    for (Role userRole : userRoles) {
        setAuths.add(new SimpleGrantedAuthority(userRole.getRoleName()));
    }

    return new ArrayList<GrantedAuthority>(setAuths);
}
}

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
/** Roles */
public static final String ROLE_ADMIN = "ADMIN";
public static final String ROLE_TEACHER = "TEACHER";
public static final String ROLE_STUDENT = "STUDENT";

private static PasswordEncoder encoder;

@Autowired
private UserDetailsService customUserDetailsService;

@Override
protected void configure(HttpSecurity http) throws Exception {
    // http.authorizeRequests().antMatchers("/auth/**").authenticated();
    //
    // http.formLogin().defaultSuccessUrl("/auth").loginPage("/login").permitAll().and().logout()
    // .logoutSuccessUrl("/logout").permitAll();
    //Para poder hacer POST en rest
    http.csrf().disable();

    // @formatter:off
    http
    .authorizeRequests()
        .antMatchers("/forgotPassword", "/passwordReset", "/register", "/registerStudent", "/resources/**", "/js/**", "**/js/**", "/static/**", "/login" ,"/","/api/**").permitAll()
        .antMatchers("/admin/**").hasAuthority(ROLE_ADMIN)
        .antMatchers("/teacher/**").hasAuthority(ROLE_TEACHER)
        .antMatchers("/student/**").hasAuthority(ROLE_STUDENT)
        .antMatchers("/**").hasAnyAuthority(ROLE_TEACHER, ROLE_ADMIN, ROLE_STUDENT)
        .antMatchers(HttpMethod.POST, "/api/**").authenticated()
    .antMatchers(HttpMethod.PUT, "/api/**").authenticated()
    .antMatchers(HttpMethod.DELETE, "/api/**").authenticated()
        //.antMatchers("/").permitAll()
        .anyRequest().authenticated()
        .and()
    .formLogin()
        .loginPage("/login")
        .successHandler(successHandler())
        .permitAll()
        .and()
    .logout()
        .permitAll();
    // @formatter:on

}

private AuthenticationSuccessHandler successHandler() {
    SimpleUrlAuthenticationSuccessHandler handler = new SimpleUrlAuthenticationSuccessHandler();
    handler.setDefaultTargetUrl("/home");
    return handler;
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(customUserDetailsService).passwordEncoder(passwordEncoder());
}

@Bean
public PasswordEncoder passwordEncoder() {
    if (encoder == null) {
        encoder = new BCryptPasswordEncoder();
    }

    return encoder;
}
}

@Configuration
@EnableWebMvcSecurity
@Order(99)
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled =     true, proxyTargetClass = true)
public class MultiHttpSecurityConfig extends    WebSecurityConfigurerAdapter {
/** Roles */
public static final String ROLE_ADMIN = "ADMIN";
public static final String ROLE_TEACHER = "TEACHER";
public static final String ROLE_STUDENT = "STUDENT";
@Autowired
protected UserDetailsService customUserDetailsService;

@Autowired
protected void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(customUserDetailsService).passwordEncoder(passwordEncoder());
}

private static PasswordEncoder encoder;
@Bean
public PasswordEncoder passwordEncoder() {
    if (encoder == null) {
        encoder = new BCryptPasswordEncoder();
    }

    return encoder;
}

@Configuration
@Order(1)
public static class ApiWebSecurityConfigurationAdapter extends       WebSecurityConfigurerAdapter {
  protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable();
      http.antMatcher("/api/**").authorizeRequests().anyRequest().hasAnyAuthority("ADMIN","STUDENT","TEACHER").anyRequest().authenticated().and().httpBasic();
  }
}

@Configuration
public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {

    //Para poder hacer POST en rest
    http.csrf().disable();
    http
      .authorizeRequests()
        .antMatchers("/forgotPassword", "/passwordReset", "/register", "/resources/**", "/js/**", "**/js/**", "/static/**", "/login" ,"/").permitAll()
        .antMatchers("/admin/**").hasAuthority(ROLE_ADMIN)
        .antMatchers("/teacher/**").hasAuthority(ROLE_TEACHER)
        .antMatchers("/student/**").hasAuthority(ROLE_STUDENT)
        .antMatchers("/**").hasAnyAuthority(ROLE_TEACHER, ROLE_ADMIN, ROLE_STUDENT)
          //.antMatchers("/").permitAll()
          .anyRequest().authenticated()
          .and()
      .formLogin()
          .loginPage("/login").permitAll()
          .successHandler(successHandler())
          .permitAll()
          .and()
      .logout()
          .permitAll();
  }
  private AuthenticationSuccessHandler successHandler() {
        SimpleUrlAuthenticationSuccessHandler handler = new SimpleUrlAuthenticationSuccessHandler();
        handler.setDefaultTargetUrl("/home");
        return handler;
    }

}
}