Simpler is better!

<security:http auto-config="true"
    access-decision-manager-ref="accessDecisionManager">
...
</security:http>

<bean id="accessDecisionManager"
    class="org.springframework.security.vote.AffirmativeBased">
  <property name="allowIfAllAbstainDecisions" value="false" />
  <property name="decisionVoters">
    <list>
      <bean class="org.springframework.security.vote.RoleVoter">
        <property name="rolePrefix" value="" /> <-- ROLE_ -->
      </bean>
    </list>
  </property>
</bean>

<filter>
  <filter-name>springSecurityFilterChain</filter-name>
  <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

<!--
<listener>
  <listener-class>
    org.springframework.security.ui.session.HttpSessionEventPublisher
  </listener-class>
</listener>
-->

<beans:beans xmlns="http://www.springframework.org/schema/security"
  xmlns:beans="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
  http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
  http://www.springframework.org/schema/security
  http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
  
  <http auto-config='true'>
    <intercept-url pattern="/**" access="ROLE_USER" />
  </http>

  <authentication-provider>
    <user-service>
      <user name="user" password="user" authorities="ROLE_USER" />
    </user-service>
  </authentication-provider>

</beans:beans>

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
  xmlns:beans="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">

  <!-- ===== HTTP AUTO CONFIG ======================================== -->

  <http auto-config="true" realm="My Security Realm"
    access-denied-page="/errors/accessDenied.jsp">
    <intercept-url pattern="/" filters="none" />
    <intercept-url pattern="/index*" filters="none" />
    <intercept-url pattern="/images/**" filters="none" />
    <intercept-url pattern="/scripts/**" filters="none" />
    <intercept-url pattern="/styles/**" filters="none" />
    <intercept-url pattern="/login.jsp*" access="ROLE_ANONYMOUS" />
    <intercept-url pattern="/admin**" access="ROLE_ADMIN" />
    <intercept-url pattern="/**" access="ROLE_USER,ROLE_ADMIN" />
    <intercept-url pattern="/**" access="IS_AUTHENTICATED_REMEMBERED" />

    <!--
    <concurrent-session-control max-sessions="1" exception-if-maximum-exceeded="true" />
    -->
    <logout logout-url="/j_security_logout" logout-success-url="/" />
    <form-login login-processing-url="/j_secutiry_check" login-page="/login.jsp"
      authentication-failure-url="/login.jsp?login_error=1"
      default-target-url="/" always-use-default-target="false" />
    <remember-me services-ref="rememberMeServices" key="someUniqueKey" />
    <http-basic />
    <anonymous />
  </http>

  <!-- ===== AUTHENTICATION PROVIDER ================================= -->

  <!--
  <authentication-provider>
    <user-service>
      <user name="admin" password="admin" authorities="ROLE_ADMIN,ROLE_USER" />
      <user name="user" password="user" authorities="ROLE_USER" />
    </user-service>
  </authentication-provider>

  <authentication-provider>
    <password-encoder hash="sha" />
    <user-service>
      <user name="admin" password="d033e22ae348aeb5660fc2140aec35850c4da997"
        authorities="ROLE_ADMIN,ROLE_USER" />
      <user name="user" password="12dea96fec20593566ab75692c9949596833adc9"
        authorities="ROLE_USER" />
    </user-service>
  </authentication-provider>

  <authentication-provider>
    <password-encoder hash="sha" base64="true" />
    <user-service>
      <user name="admin" password="0DPiKuNIrrVmD8IUCuw1hQxNqZc=" 
        authorities="ROLE_ADMIN,ROLE_USER" />
      <user name="user" password="Et6pb+wgWTVmq3VpLJlJWWgzrck="
        authorities="ROLE_USER" />
    </user-service>
  </authentication-provider>
  -->

  <!--( md5 | sha )-->
  <authentication-provider user-service-ref="userService">
    <password-encoder hash="sha" base64="true" />
  </authentication-provider>

  <beans:bean id="rememberMeServices"
    class="org.springframework.security.ui.rememberme.TokenBasedRememberMeServices">
    <beans:property name="userDetailsService" ref="userService" />
    <beans:property name="key" value="someUniqueKey" />
    <beans:property name="parameter" value="rememberMe" />
  </beans:bean>

  <!-- ===== LOGGER LISTENER ========================================= -->

  <beans:bean id="loggerListener"
    class="org.springframework.security.event.authentication.LoggerListener" />

</beans:beans>

<?xml version="1.0" encoding="utf-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:security="http://www.springframework.org/schema/security"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
    http://www.springframework.org/schema/security 
    http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">

  <!-- ===== HTTP CONFIG ============================================= -->

  <security:http realm="My Security Realm"
    entry-point-ref="authenticationProcessingFilterEntryPoint"
    access-denied-page="/errors/accessDenied.jsp">

    <security:intercept-url pattern="/" filters="none" />
    <security:intercept-url pattern="/index*" filters="none" />
    <security:intercept-url pattern="/images/**" filters="none" />
    <security:intercept-url pattern="/scripts/**" filters="none" />
    <security:intercept-url pattern="/styles/**" filters="none" />
    <security:intercept-url pattern="/login.jsp*" access="ROLE_ANONYMOUS" />
    <security:intercept-url pattern="/admin**" access="ROLE_ADMIN" />
    <security:intercept-url pattern="/**" access="ROLE_USER,ROLE_ADMIN" />
    <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_REMEMBERED" />

    <!--
    <security:concurrent-session-control max-sessions="1" exception-if-maximum-exceeded="true" />
    -->
    <security:http-basic />
    <security:anonymous />
  </security:http>

  <!-- ===== AUTHENTICATION MAMANGER & PROVIDER ====================== -->

  <security:authentication-manager alias="authenticationManager" />

  <security:authentication-provider user-service-ref="userService">
    <security:password-encoder hash="sha" base64="true" />
  </security:authentication-provider>

  <!-- ===== LOGOUT_FILTER =========================================== -->

  <bean id="logoutFilter" class="org.springframework.security.ui.logout.LogoutFilter">
    <!-- Sets this as the logout filter over the default -->
    <security:custom-filter position="LOGOUT_FILTER" />
    <constructor-arg value="/" />
    <constructor-arg>
      <list>
        <ref bean="rememberMeServices" />
        <bean
          class="org.springframework.security.ui.logout.SecurityContextLogoutHandler" />
      </list>
    </constructor-arg>
    <property name="filterProcessesUrl" value="/j_security_logout" />
  </bean>

  <!-- ===== AUTHENTICATION_PROCESSING_FILTER =======================  -->

  <bean id="authenticationProcessingFilterEntryPoint"
    class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
    <property name="loginFormUrl" value="/login.jsp" />
    <property name="forceHttps" value="false" />
  </bean>

  <bean id="authenticationProcessingFilter"
    class="org.springframework.security.ui.webapp.AuthenticationProcessingFilter">
    <!-- Sets this as the authentication filter over the default -->
    <security:custom-filter position="AUTHENTICATION_PROCESSING_FILTER" />
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="authenticationFailureUrl" value="/login.jsp?login_error=1" />
    <property name="defaultTargetUrl" value="/" />
    <property name="filterProcessesUrl" value="/j_security_check" />
    <property name="rememberMeServices" ref="rememberMeServices" />
    <property name="exceptionMappings">
      <props>
        <prop key="org.springframework.security.BadCredentialsException">/login.jsp?login_error=2</prop>
        <prop key="org.springframework.security.DisabledException">/login.jsp?login_error=3</prop>
        <prop key="org.springframework.security.LockedException">/login.jsp?login_error=4</prop>
        <prop key="org.springframework.security.AccountExpiredException">/login.jsp?login_error=5</prop>
        <prop key="org.springframework.security.CredentialsExpiredException">/login.jsp?login_error=6</prop>
        <prop key="org.springframework.security.concurrent.ConcurrentLoginException">/login.jsp?login_error=7</prop>
      </props>
    </property>
  </bean>

  <!-- ===== REMEMBER_ME_FILTER ====================================== -->

  <bean id="rememberMeProcessingFilter"
    class="org.springframework.security.ui.rememberme.RememberMeProcessingFilter">
    <!-- Sets this as the remember me filter over the default -->
    <security:custom-filter position="REMEMBER_ME_FILTER" />
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="rememberMeServices" ref="rememberMeServices" />
  </bean>

  <bean id="rememberMeServices"
    class="org.springframework.security.ui.rememberme.TokenBasedRememberMeServices">
    <property name="userDetailsService" ref="userService" />
    <property name="key" value="someUniqueKey" />
    <property name="parameter" value="rememberMe" />
  </bean>

  <bean id="rememberMeAuthenticationProvider"
    class="org.springframework.security.providers.rememberme.RememberMeAuthenticationProvider">
    <security:custom-authentication-provider />
    <property name="key" value="someUniqueKey" />
  </bean>

  <!-- ===== LOGGER LISTENER ========================================= -->

  <bean id="loggerListener"
    class="org.springframework.security.event.authentication.LoggerListener" />

</beans>

<?xml version="1.0" encoding="utf-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:security="http://www.springframework.org/schema/security"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">

  <!-- =============================================================== -->
  <!-- Spring Security Filter Chain                                    -->
  <!-- =============================================================== -->

  <bean id="springSecurityFilterChain" class="org.springframework.security.util.FilterChainProxy">
    <security:filter-chain-map path-type="ant">
      <security:filter-chain pattern="/" filters="none" />
      <security:filter-chain pattern="/index*" filters="none" />
      <security:filter-chain pattern="/images/**" filters="none" />
      <security:filter-chain pattern="/scripts/**" filters="none" />
      <security:filter-chain pattern="/styles/**" filters="none" />
      <security:filter-chain pattern="/**"
        filters="httpSessionContextIntegrationFilter,
                logoutFilter,
                authenticationProcessingFilter,
                basicProcessingFilter,
                securityContextHolderAwareRequestFilter,
                rememberMeProcessingFilter,
                anonymousProcessingFilter,
                exceptionTranslationFilter,
                filterSecurityInterceptor" />
    </security:filter-chain-map>
  </bean>

  <!-- =============================================================== -->
  <!-- FILTERS                                                         -->
  <!-- =============================================================== -->

  <!-- ===== CONCURRENT_SESSION_FILTER =============================== -->
  <!--
  <bean id="concurrentSessionFilter"
    class="org.springframework.security.concurrent.ConcurrentSessionFilter">
    <property name="sessionRegistry" ref="sessionRegistry" />
    <property name="expiredUrl" value="/" />
  </bean>

  <bean id="concurrentSessionController"
    class="org.springframework.security.concurrent.ConcurrentSessionControllerImpl">
    <property name="maximumSessions" value="1" />
    <property name="exceptionIfMaximumExceeded" value="true" />
    <property name="sessionRegistry" ref="sessionRegistry" />
  </bean>

  <bean id="sessionRegistry" class="org.springframework.security.concurrent.SessionRegistryImpl" />
  -->

  <!-- ===== SESSION_CONTEXT_INTEGRATION_FILTER ====================== -->

  <bean id="httpSessionContextIntegrationFilter"
    class="org.springframework.security.context.HttpSessionContextIntegrationFilter" />

  <!-- ===== LOGOUT_FILTER =========================================== -->

  <bean id="logoutFilter" class="org.springframework.security.ui.logout.LogoutFilter">
    <constructor-arg value="/" />
    <constructor-arg>
      <list>
        <ref bean="rememberMeServices" />
        <bean
          class="org.springframework.security.ui.logout.SecurityContextLogoutHandler" />
      </list>
    </constructor-arg>
    <property name="filterProcessesUrl" value="/j_security_logout" />
  </bean>

  <!-- ===== AUTHENTICATION_PROCESSING_FILTER =======================  -->

  <bean id="authenticationProcessingFilter"
    class="org.springframework.security.ui.webapp.AuthenticationProcessingFilter">
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="authenticationFailureUrl" value="/login.jsp?login_error=1" />
    <property name="defaultTargetUrl" value="/" />
    <property name="filterProcessesUrl" value="/j_security_check" />
    <property name="rememberMeServices" ref="rememberMeServices" />
    <property name="exceptionMappings">
      <props>
        <prop key="org.springframework.security.BadCredentialsException">/login.jsp?login_error=2</prop>
        <prop key="org.springframework.security.DisabledException">/login.jsp?login_error=3</prop>
        <prop key="org.springframework.security.LockedException">/login.jsp?login_error=4</prop>
        <prop key="org.springframework.security.AccountExpiredException">/login.jsp?login_error=5</prop>
        <prop key="org.springframework.security.CredentialsExpiredException">/login.jsp?login_error=6</prop>
        <prop key="org.springframework.security.concurrent.ConcurrentLoginException">/login.jsp?login_error=7</prop>
      </props>
    </property>
  </bean>

  <bean id="formAuthenticationEntryPoint"
    class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
    <property name="loginFormUrl" value="/login.jsp" />
    <property name="forceHttps" value="false" />
  </bean>

  <!-- ===== BASIC_PROCESSING_FILTER ================================= -->

  <bean id="basicProcessingFilter"
    class="org.springframework.security.ui.basicauth.BasicProcessingFilter">
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="authenticationEntryPoint" ref="basicAuthenticationEntryPoint" />
  </bean>

  <bean id="basicAuthenticationEntryPoint"
    class="org.springframework.security.ui.basicauth.BasicProcessingFilterEntryPoint">
    <property name="realmName" value="My Security Realm" />
  </bean>

  <!-- ===== SERVLET_API_SUPPORT_FILTER ============================== -->

  <bean id="securityContextHolderAwareRequestFilter"
    class="org.springframework.security.wrapper.SecurityContextHolderAwareRequestFilter" />

  <!-- ===== REMEMBER_ME_FILTER ====================================== -->

  <bean id="rememberMeProcessingFilter"
    class="org.springframework.security.ui.rememberme.RememberMeProcessingFilter">
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="rememberMeServices" ref="rememberMeServices" />
  </bean>

  <bean id="rememberMeServices"
    class="org.springframework.security.ui.rememberme.TokenBasedRememberMeServices">
    <property name="userDetailsService" ref="userService" />
    <property name="key" value="someUniqueKey" />
    <property name="parameter" value="rememberMe" />
  </bean>

  <!-- ===== ANONYMOUS_FILTER ======================================== -->

  <bean id="anonymousProcessingFilter"
    class="org.springframework.security.providers.anonymous.AnonymousProcessingFilter">
    <property name="key" value="anonymous" />
    <property name="userAttribute" value="anonymous,ROLE_ANONYMOUS" />
  </bean>

  <!-- ===== EXCEPTION_TRANSLATION_FILTER ============================ -->

  <bean id="exceptionTranslationFilter" 
      class="org.springframework.security.ui.ExceptionTranslationFilter">
    <property name="authenticationEntryPoint" ref="formAuthenticationEntryPoint" />
    <property name="accessDeniedHandler">
      <bean class="org.springframework.security.ui.AccessDeniedHandlerImpl">
        <property name="errorPage" value="/errors/accessDenied.jsp" />
      </bean>
    </property>
  </bean>

  <!-- ===== FILTER_SECURITY_INTERCEPTOR ============================ -->

  <bean id="filterSecurityInterceptor"
    class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="accessDecisionManager" ref="accessDecisionManager" />
    <property name="objectDefinitionSource">
      <security:filter-invocation-definition-source
        id="filterInvocationDefinitionSource" lowercase-comparisons="true"
        path-type="ant">
        <security:intercept-url pattern="/login.jsp*" access="ROLE_ANONYMOUS" />
        <security:intercept-url pattern="/admin**"
          access="ROLE_ADMIN" />
        <security:intercept-url pattern="/**"
          access="ROLE_USER,ROLE_ADMIN" />
      </security:filter-invocation-definition-source>
    </property>
  </bean>

  <bean id="accessDecisionManager" class="org.springframework.security.vote.AffirmativeBased">
    <property name="allowIfAllAbstainDecisions" value="false" />
    <property name="decisionVoters">
      <list>
        <bean class="org.springframework.security.vote.RoleVoter" />
      </list>
    </property>
  </bean>

  <!-- =============================================================== -->
  <!-- AUTHENTICATION MANAGER & PROVIDER                               -->
  <!-- =============================================================== -->

  <bean id="authenticationManager" class="org.springframework.security.providers.ProviderManager">
    <property name="providers">
      <list>
        <ref local="daoAuthenticationProvider" />
        <ref local="anonymousAuthenticationProvider" />
        <ref local="rememberMeAuthenticationProvider" />
      </list>
    </property>
    <!--<property name="sessionController" ref="concurrentSessionController" />-->
  </bean>

  <bean id="daoAuthenticationProvider"
    class="org.springframework.security.providers.dao.DaoAuthenticationProvider">
    <property name="userDetailsService" ref="userService" />
    <property name="passwordEncoder" ref="passwordEncoder" />
  </bean>

  <bean id="anonymousAuthenticationProvider"
    class="org.springframework.security.providers.anonymous.AnonymousAuthenticationProvider">
    <property name="key" value="anonymous" />
  </bean>

  <bean id="rememberMeAuthenticationProvider"
    class="org.springframework.security.providers.rememberme.RememberMeAuthenticationProvider">
    <property name="key" value="someUniqueKey" />
  </bean>

  <!--( ShaPasswordEncoder | Md5PasswordEncoder )-->
  <bean id="passwordEncoder"
    class="org.springframework.security.providers.encoding.ShaPasswordEncoder">
    <!--<constructor-arg value="256" />-->
    <property name="encodeHashAsBase64" value="true" />
  </bean>

  <!-- ===== LOGGER LISTENER ========================================= -->

  <bean id="loggerListener"
    class="org.springframework.security.event.authentication.LoggerListener" />

</beans>

# For PHP 5 do something like this:
LoadModule php5_module "C:/php-5.3.0/php5apache2_2.dll"
AddType application/x-httpd-php .php

# Configure the path to php.ini (rename php-* into php.ini):
PHPIniDir "C:/php-5.3.0"

# Add the following two lines inside :
#<IFMODULE mime_module>
#    AddType application/x-httpd-php .php
#    AddType application/x-httpd-php-source .phps
#</IFMODULE>

# Add default index file (index.php):
#<IFMODULE dir_module>
#    DirectoryIndex index.html index.php
#</IFMODULE>

extension_dir = "C:/php-5.3.0/ext"

...
extension=php_mysql.dll
...

<?php phpinfo(); ?>

<Engine name="Catalina" defaultHost="mydomain.com">

    <Host name="localhost" appBase="webapps" unpackWARs="true"
        autoDeploy="true" xmlValidation="false"
        xmlNamespaceAware="false">
    </Host>

    <Host name="mydomain.com" appBase="/home/mydomain"
        unpackWARs="true" autoDeploy="true" xmlValidation="false"
        xmlNamespaceAware="false">
        <Alias>www.mydomain.com</Alias>
        <Alias>test.mydomain.com</Alias>
        <Context path="" docBase="www" debug="0" />
    </Host>

</Engine>

# Define 1 real worker using ajp13
worker.list=worker1

# Set properties for worker1 (ajp13)
worker.worker1.type=ajp13
worker.worker1.host=localhost
worker.worker1.port=8009

# Load mod_jk module
# Update this path to match your modules location
LoadModule jk_module modules/mod_jk.so

# Where to find workers.properties
# Update this path to match your conf directory location
JkWorkersFile C:/Apache2.2/conf/workers.properties

#----- 아래 설정은 가상호스트 설정에 둘 수 있음 -----
# Where to put jk logs
# Update this path to match your logs directory location
#JkLogFile C:/Apache2.2/logs/mod_jk.log

# Set the jk log level [debug/error/info]
#JkLogLevel info

# Select the log format
#JkLogStampFormat "[%a %b %d %H:%M:%S %Y]"

# JkOptions indicate to send SSL KEY SIZE,
#JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories

# JkRequestLogFormat set the request format
#JkRequestLogFormat "%w %V %T"

# Send everything for context /*.jsp to worker named worker1 (ajp13)
#JkMount /*.jsp worker1

# Send everything for context /examples to worker named worker1 (ajp13)
#JkMount /examples worker1
#JkMount /examples/* worker1

NameVirtualHost *:80

<VirtualHost *:80>
    ServerAdmin webmaster@mydomain.com
    DocumentRoot "C:/Home/mydomain/htdocs"
    ServerAlias www.mydomain.com
    ServerAlias mydomain.com
    ServerAlias *.mydomain.com
    ErrorLog "C:/Home/mydomain/logs/mydomain.com-error.log"
    CustomLog "C:/Home/mydomain/logs/mydomain.com-access.log" common

    #----- 아래 JK 설정 -----
    # Where to put jk logs
    # Update this path to match your logs directory location
    JkLogFile C:/Home/mydomain/logs/mod_jk.log

    # Set the jk log level [debug/error/info]
    JkLogLevel info

    # Select the log format
    JkLogStampFormat "[%a %b %d %H:%M:%S %Y]"

    # JkOptions indicate to send SSL KEY SIZE,
    JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories

    # JkRequestLogFormat set the request format
    JkRequestLogFormat "%w %V %T"

    # Send everything for context /*.jsp to worker named worker1 (ajp13)
    JkMount /*.jsp worker1

    # Send everything for context /examples to worker named worker1 (ajp13)
    JkMount /examples worker1
    JkMount /examples/* worker1
</VirtualHost>

<VirtualHost *:80>
    ServerAdmin webmaster@java2go.net
    DocumentRoot "C:/Home/dummy-host/htdocs"
    ServerName dummy-host.com
    ServerAlias www.dummy-host.com
    ErrorLog "C:/Home/dummy-host/logs/dummy-host.com-error.log"
    CustomLog "C:/Home/dummy-host/logs/dummy-host.com-access.log" common
</VirtualHost>

<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />