+1  A: 

If you are getting a 403 code, means that the user does not have the required roles. So, athentication is not the problem, is authorization.
The only way to know what is going on is to put logging level to debug, there should be more info. Post it here.
Does your roles has de ROLE_ prefix?

rodrigoap  2009-08-15 18:52:09
Good points, sorry about the bonehead post, been too tired and distracted to think straight :-(
vector  2009-08-17 16:11:18
A: 

... figured it out. Despite having ROLE_TEST specified in the config file and the same in the 'authority' column of the db, Spring-Sec was expecting ROLE_SUPERVISOR:

[DEBUG,AbstractSecurityInterceptor,http-8084-7] Secure object: FilterInvocation: URL: /admin/test.jsp; ConfigAttributes: [ROLE_TEST]
[DEBUG,AbstractSecurityInterceptor,http-8084-7] Previously Authenticated: org.springframework.security.providers.UsernamePasswordAuthenticationToken@af840ed7: Principal: org.springframework.security.userdetails.User@3ec100: Username: testUser; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_SUPERVISOR; Password: [PROTECTED]; Authenticated: true; Details: org.springframework.security.ui.WebAuthenticationDetails@1c07a: RemoteIpAddress: 127.0.0.1; SessionId: 350B260FAFDDBF04D5CB4AAAB7B8A441; Granted Authorities: ROLE_SUPERVISOR
[DEBUG,ExceptionTranslationFilter,http-8084-7] Access is denied (user is not anonymous); delegating to AccessDeniedHandler
org.springframework.security.AccessDeniedException: Access is denied
        at org.springframework.security.vote.AffirmativeBased.decide(AffirmativeBased.java:68)

... now I'm curious, how come? So after changing ROLE_TEST to ROLE_SUPERVISOR in the config file all worked as expected.

vector  2009-08-17 16:22:49
.... I realized today that all this time I was looking at the wrong db, 'nough said.Thaks a bunch though, it did help!
vector  2009-08-18 18:05:43

related questions

Acegi/Spring Security Grails plug-in not seeing changes to a User instance
different DelegatingFilterProxy and FilterToBeanProxy
How to immediately enable the authority after update user authority in spring security?
springdoclet usage?
Grails Security Problem and Search Engine optimization
Spring Security: Advice needed on how to handle GrantedAuthority
Why is my (Spring Security) servlet filter getting called twice?
Grails Acegi Plugin springsecurity.GrailsDaoImpl - User [admin] has no GrantedAuthority
Spring Security: What is the UserDetailsManager interface used for? And more!
Combining namespace based configuration with different authentication methods in spring-security
Spring Security: Custom Authentication Provider for 'one time password' and 'securit questions'
Spring Security: How to get the initial target url
Permissions checking in server-side API
Cannot locate 'org.springframework.security.annotation.Jsr250MethodDefinitionSource'
How to grant access for all authenticated users?
Spring embedded ldap server in unit tests
What are some good sample applications using Spring and Hibernate?
Problem migrating Spring Web App from tomcat 5.5 to tomcat 6.0
How to throw an informative exception from AccessDecisionManager that uses voters
How can I determine what roles are required to access a URL with Spring Security?
Creating a custom authentication with Acegi/Spring Security
Unit testing with Spring Security
Securing Remote Access over JMXMP with Spring Security
When using Spring Security, what is the proper way to obtain current username (i.e. SecurityContext) information in a bean?
Spring security: adding "On unsuccessful login event listener"