 <p>Personally, for the admin account I won't go with the basic Spring Security user service, mainly because it lacks the flexibility of a DB-based user management approach. Indeed, you probably don't want to have your admin credentials established once for all, since they can be guessed or stolen or simply forgotten.</p> <p>Conversely, both password <strong>modification and recovery mechanisms</strong> should be put in place for all accounts, including the admin one (provided you use a trusted email account for password recovery, but this is a reasonable assumption).</p> <p>Getting concrete, my approach is the following: I use an <code>AuthenticationManager</code> where I inject a <code>CustomUserDetailService</code></p> <pre><code> &lt;authentication-manager alias="authenticationManager"&gt; &lt;authentication-provider user-service-ref="customUserDetailsService" &gt; &lt;password-encoder ref="passwordEncoder" /&gt; &lt;/authentication-provider&gt; &lt;/authentication-manager&gt; &lt;b:bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" /&gt; </code></pre> <p>which is the following</p> <pre><code> @Service public class CustomUserDetailsService implements UserDetailsService{ @Autowired @Qualifier("userDaoImpl") private UserDao userDaoImpl; @Override @Transactional public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { User user = userDaoImpl.loadByUsername(username); if (user != null) return user; else throw new UsernameNotFoundException(username + " not found."); } } </code></pre> <p>this works for all users, not only the admin.</p> <p>Now it comes <strong>the problem of having the admin account full functional when the application starts</strong>. This is accomplished by using an <strong>initialization</strong> bean to be executed at startup, detailed in the following</p> <pre><code> @Component public class Initializer { @Autowired private HibernateTransactionManager transactionManager; @Autowired @Qualifier("userDaoImpl") private UserDao userDao; @Autowired private CredentialsManager credentialsManager; private String resetPassword = "makeItHardToGuess"; private String adminUsername = "admin"; @PostConstruct private void init() { //since we are executing on startup, we need to use a TransactionTemplate directly as Spring may haven't setup transction capabilities yet TransactionTemplate trxTemplate = new TransactionTemplate(transactionManager); trxTemplate.execute(new TransactionCallbackWithoutResult() { @Override protected void doInTransactionWithoutResult(TransactionStatus status) { buildAdmin(); } }); } private void buildAdmin() { //here I try to retrieve the Admin from my persistence layer ProfiledUser admin = userDao.loadByUsername(adminUsername); try { //If the application is started for the first time (e.g., the admin is not in the DB) if(admin==null) { //create a user for the admin admin = new ProfiledUser(); //and fill her attributes accordingly admin.setUsername(adminUsername); admin.setPassword(credentialsManager.encodePassword(resetPassword)); admin.setAccountNonExpired(true); admin.setAccountNonLocked(true); admin.setCredentialsNonExpired(true); admin.setEnabled(true); admin.setEulaAccepted(true); Authority authority = new Authority(); authority.setAuthority("ROLE_ADMIN"); admin.getAuthorities().add(authority); } //if the application has previously been started (e.g., the admin is already present in the DB) else { //reset admin's attributes admin.setPassword(credentialsManager.encodePassword(resetPassword)); admin.getAuthorities().clear(); Authority authority = new Authority(); authority.setAuthority("ROLE_ADMIN"); admin.getAuthorities().add(authority); admin.setAccountNonExpired(true); admin.setAccountNonLocked(true); admin.setCredentialsNonExpired(true); admin.setEnabled(true); } userDao.save(admin); } catch (Exception e) { e.printStackTrace(); System.out.println("Errors occurred during initialization. System verification is required."); } } } </code></pre> <p>please note that the <code>@PostConstruct</code> annotation does not guarantee that spring has its transaction services available, that's why I had to manage the transaction my own. Please refer to <a href="http://stackoverflow.com/questions/19876637/how-to-get-transactions-to-a-postconstruct-cdi-bean-method/20740252#20740252">this</a> for more details.</p>