title: spring security- How to invoke controller method for authentication & authorization on login
body: <p>I need to integrate Spring security in an existing Spring MVC project (Spring 3.2.13 +MyBatis+PostgreSQL). I'm new to Spring Security.
  <br><br>
  I'm able to login into the application when credentials are hard-coded into the spring-security.xml (Spring Security 3.2.5).<br>
  But, in the existing implementation (without spring security), controller authenticates &amp; based on user status, redirects to respective JSP<br>
  <strong>Here is the Controller :</strong></p>
  
  <pre><code>@RequestMapping(value="/login", method=RequestMethod.POST)
  public String processLogin(@ModelAttribute(value="loginUser")UserForm user, Model model) {
  //Spring Validation here
  ...
  User authenticatedUser = userMgmtService.processUserLogin(loggedInUser);
  
  if(authenticatedUser!= null){               
              if(authenticatedUser.getStatus().equals(UserStatusConstants.USER_ACTIVE)){
                  if(authenticatedUser.getAdminFlag()){
                      viewName= "redirect:/admin/adminHome.html";
                  }               
                  else{
                      viewName= "redirect:/home.html";
                  }
              }
              else if(authenticatedUser.getStatus().equals(UserStatusConstants.USER_NEW)){
                  viewName="redirect:/changePassword.html";
              }
              else if(authenticatedUser.getStatus().equals(UserStatusConstants.USER_LOCKED)){
                      viewName="redirect:/accountLockedOut.html";
              }
              else if(authenticatedUser.getStatus().equals(UserStatusConstants.USER_INACTIVE)){
                  viewName="redirect:/accessDenied.html";
              }
  
              model.addAttribute("loginUser",authenticatedUser);
          }
  
   return viewName;
  </code></pre>
  
  <p><strong>Here is the User Class : <br></strong></p>
  
  <pre><code>@Component
  public class User {
  
      private String userName;
  
      private String password;
  
      private String firstName;
  
      private String lastName;
  
      /** Flag whether the user is admin or not */
      private Boolean adminFlag;
  
      /** Status Num for New, Active, Locked, Inactive */
      private Integer status;
  
      private Date lastLoginTimestamp;
  
      //Getters &amp; Setters
      ....
  }
  </code></pre>
  
  <p>Roles : I have just two roles in the system SUPERUSER (when adminFlag = true) and APPUSER (when adminFlag = false). And Status 0=New, 1=Active, 2=Locked, 3=Inactive
  <br>
  <strong>Here is my USER Database Table :</strong><br>
   <a href="https://i.stack.imgur.com/bDNMK.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/bDNMK.jpg" alt="enter image description here"></a>
  <br>
  <strong>My spring-security.xml :</strong></p>
  
  <pre><code> &lt;!-- Bypass security for resources - css,images,scripts  --&gt;
     &lt;http pattern="/resources/**" security="none"/&gt;
  
     &lt;http auto-config="true"&gt;
      &lt;intercept-url pattern="/login*" access="ROLE_ANONYMOUS,ROLE_APPUSER,ROLE_SUPERUSER"/&gt;
      &lt;intercept-url pattern="/forgotPassword*" access="ROLE_ANONYMOUS,ROLE_APPUSER,ROLE_SUPERUSER"/&gt;
      &lt;intercept-url pattern="/logout" access="ROLE_ANONYMOUS,ROLE_APPUSER,ROLE_SUPERUSER"/&gt;
      &lt;intercept-url pattern="/admin/" access="ROLE_SUPERUSER"/&gt;
      &lt;intercept-url pattern="/**" access="ROLE_APPUSER"/&gt;
  
      &lt;form-login login-page="/login.html"                
                  login-processing-url="/login"
                  authentication-failure-url="/login.html?autherror=true"
                  username-parameter="userName"
                  password-parameter="password"
                  default-target-url="/home.html"
                  always-use-default-target="false"/&gt;
      &lt;logout invalidate-session="true" delete-cookies="JSESSIONID,user" logout-success-url="/logout"/&gt;       
      &lt;access-denied-handler error-page="/accessDenied"/&gt;     
      &lt;session-management&gt;
                  &lt;!-- Listener HttpSessionEventPublisher (in web.xml) notifies of concurrent sessions --&gt;
                  &lt;concurrency-control max-sessions="1" error-if-maximum-exceeded="true"/&gt;
       &lt;/session-management&gt;
  
  
         &lt;/http&gt;
  
    &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;
              &lt;user-service&gt;
                  &lt;user name="user1" password="123" authorities="ROLE_APPUSER"/&gt;
                  &lt;user name="superuser" password="admin" authorities="ROLE_SUPERUSER"/&gt;
              &lt;/user-service&gt;
          &lt;/authentication-provider&gt;   
    &lt;/authentication-manager&gt;
  </code></pre>
  
  <p><strong>Requirement :</strong> How to use spring-security to perform the controller logic shown above? What changes do I need to make in the existing implementation?</p>