Getting Access is denied in login page_问答_开发者

i am using spring security 3 with JSF 2 ICEFaces 2 and i configured my application as follows:

All the pages are protected (requires authentication) except for login.
Login page is non filtered, so any user can access it.

the problem: when trying to run app, user is redirected to home page, but he's not logged in so he's redirected to login page, page loads fine, and i am using spring security in debug mode, so i can see the access denied exception.

here's my code:

<beans:beans xmlns="http://www.springframework.org/schema/security"  
xmlns:beans="http://www.springframework.org/schema/beans" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
      http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
      http://www.springframework.org/schema/security
      http://www.springframework.org/schema/security/spring-security-3.0.4.xsd">


    <global-method-security pre-post-annotations="enabled" />   

    <!--  key configuration here is an entry point to be used by security intercepts -->
    <http use-expressions="true"  auto-config="false">

    <session-management session-fixation-protection="none"/>

    <remember-me  token-validity-seconds="1209600"/>

    <!-- Exclude the login page from the security check -->
    <intercept-url pattern="/faces/login.xhtml" access="permitAll"/>

    <!-- All pages requires authentication (not anonymous user) -->
    <intercept-url pattern="/faces/**" access="isAuthenticated()" />

    <intercept-url pattern="/images/**" filters="none" />
    <intercept-url pattern="/scripts/**" filters="none" />
    <intercept-url pattern="/css/**" filters="none" />  

    <!-- Returns true if the user is not anonymous -->


    <access-denied-handler error-page="/error"/>

    <form-login default-target-url="/users"  
    always-use-default-target="true"            
        login-processing-url="/j_spring_security_check"         
        login-page="/faces/login.xhtml"
        authentication-failure-url="/login?login_error=1"                                                               
    />

    <logout logout-url="/logout" logout-success-url="/login" />     
</http>

<authentication-manager alias="authenticationManager">          
<authentication-provider user-service-ref="userDetailsServiceImpl">
</authentication-provider>
</authentication-manager>


</beans:beans>

and here's debug:

DEBUG [http-8080-5] (FilterChainProxy.java:202) - Candidate is: '/faces/login.xhtml'; pattern is /css/**; matched=false
DEBUG [http-8080-5] (FilterChainProxy.java:195) - Converted URL to lowercase, from: '/faces/login.xhtml'; to: '/faces/login.xhtml'
DEBUG [http-8080-5] (FilterChainProxy.java:202) - Candidate is: '/faces/login.xhtml'; pattern is /**; matched=true
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 1 of 9 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
DEBUG [http-8080-5] (HttpSessionSecurityContextRepository.java:142) - HttpSession returned null object for SPRING_SECURITY_CONTEXT
DEBUG [http-8080-5] (HttpSessionSecurityContextRepository.java:88) - No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade@118eb00c. A new one will be created.
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 2 of 9 in additional filter chain; firing Filter: 'LogoutFilter'
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 3 of 9 in addition开发者_开发百科al filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 4 of 9 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
DEBUG [http-8080-5] (DefaultSavedRequest.java:336) - pathInfo: arg1=/javax.faces.resource/compat.js; arg2=/login.xhtml (property not equals)
DEBUG [http-8080-5] (HttpSessionRequestCache.java:72) - saved request doesn't match
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 5 of 9 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 6 of 9 in additional filter chain; firing Filter: 'RememberMeAuthenticationFilter'
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 7 of 9 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
DEBUG [http-8080-5] (AnonymousAuthenticationFilter.java:67) - Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@9057bc48: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: A5721C800637CFCD4F6EF9E512468F64; Granted Authorities: ROLE_ANONYMOUS'
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 8 of 9 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 9 of 9 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
DEBUG [http-8080-5] (DefaultFilterInvocationSecurityMetadataSource.java:173) - Converted URL to lowercase, from: '/faces/login.xhtml'; to: '/faces/login.xhtml'
DEBUG [http-8080-5] (DefaultFilterInvocationSecurityMetadataSource.java:200) - Candidate is: '/faces/login.xhtml'; pattern is /faces/login.xhtml; matched=true
DEBUG [http-8080-5] (AbstractSecurityInterceptor.java:191) - Secure object: FilterInvocation: URL: /faces/login.xhtml; Attributes: [permitAll]
DEBUG [http-8080-5] (AbstractSecurityInterceptor.java:292) - Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9057bc48: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: A5721C800637CFCD4F6EF9E512468F64; Granted Authorities: ROLE_ANONYMOUS
DEBUG [http-8080-5] (AffirmativeBased.java:53) - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@20688e91, returned: 1
DEBUG [http-8080-5] (AbstractSecurityInterceptor.java:213) - Authorization successful
DEBUG [http-8080-5] (AbstractSecurityInterceptor.java:223) - RunAsManager did not change Authentication object
DEBUG [http-8080-5] (FilterChainProxy.java:362) - /faces/login.xhtml reached end of additional filter chain; proceeding with original chain
DEBUG [http-8080-5] (ExceptionTranslationFilter.java:100) - Chain processed normally
DEBUG [http-8080-5] (HttpSessionSecurityContextRepository.java:338) - SecurityContext is empty or anonymous - context will not be stored in HttpSession. 
DEBUG [http-8080-5] (SecurityContextPersistenceFilter.java:89) - SecurityContextHolder now cleared, as request processing completed
DEBUG [http-8080-5] (FilterChainProxy.java:195) - Converted URL to lowercase, from: '/faces/login.xhtml'; to: '/faces/login.xhtml'
DEBUG [http-8080-2] (FilterChainProxy.java:195) - Converted URL to lowercase, from: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'; to: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'
DEBUG [http-8080-5] (FilterChainProxy.java:202) - Candidate is: '/faces/login.xhtml'; pattern is /images/**; matched=false
DEBUG [http-8080-3] (FilterChainProxy.java:195) - Converted URL to lowercase, from: '/faces/javax.faces.resource/combined.css'; to: '/faces/javax.faces.resource/combined.css'
DEBUG [http-8080-5] (FilterChainProxy.java:195) - Converted URL to lowercase, from: '/faces/login.xhtml'; to: '/faces/login.xhtml'
DEBUG [http-8080-2] (FilterChainProxy.java:202) - Candidate is: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'; pattern is /images/**; matched=false
DEBUG [http-8080-5] (FilterChainProxy.java:202) - Candidate is: '/faces/login.xhtml'; pattern is /scripts/**; matched=false
DEBUG [http-8080-3] (FilterChainProxy.java:202) - Candidate is: '/faces/javax.faces.resource/combined.css'; pattern is /images/**; matched=false
DEBUG [http-8080-5] (FilterChainProxy.java:195) - Converted URL to lowercase, from: '/faces/login.xhtml'; to: '/faces/login.xhtml'
DEBUG [http-8080-2] (FilterChainProxy.java:195) - Converted URL to lowercase, from: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'; to: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'
DEBUG [http-8080-5] (FilterChainProxy.java:202) - Candidate is: '/faces/login.xhtml'; pattern is /css/**; matched=false
DEBUG [http-8080-3] (FilterChainProxy.java:195) - Converted URL to lowercase, from: '/faces/javax.faces.resource/combined.css'; to: '/faces/javax.faces.resource/combined.css'
DEBUG [http-8080-5] (FilterChainProxy.java:195) - Converted URL to lowercase, from: '/faces/login.xhtml'; to: '/faces/login.xhtml'
DEBUG [http-8080-2] (FilterChainProxy.java:202) - Candidate is: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'; pattern is /scripts/**; matched=false
DEBUG [http-8080-5] (FilterChainProxy.java:202) - Candidate is: '/faces/login.xhtml'; pattern is /**; matched=true
DEBUG [http-8080-3] (FilterChainProxy.java:202) - Candidate is: '/faces/javax.faces.resource/combined.css'; pattern is /scripts/**; matched=false
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 1 of 9 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
DEBUG [http-8080-2] (FilterChainProxy.java:195) - Converted URL to lowercase, from: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'; to: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'
DEBUG [http-8080-5] (HttpSessionSecurityContextRepository.java:142) - HttpSession returned null object for SPRING_SECURITY_CONTEXT
DEBUG [http-8080-3] (FilterChainProxy.java:195) - Converted URL to lowercase, from: '/faces/javax.faces.resource/combined.css'; to: '/faces/javax.faces.resource/combined.css'
DEBUG [http-8080-5] (HttpSessionSecurityContextRepository.java:88) - No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade@118eb00c. A new one will be created.
DEBUG [http-8080-2] (FilterChainProxy.java:202) - Candidate is: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'; pattern is /css/**; matched=false
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 2 of 9 in additional filter chain; firing Filter: 'LogoutFilter'
DEBUG [http-8080-3] (FilterChainProxy.java:202) - Candidate is: '/faces/javax.faces.resource/combined.css'; pattern is /css/**; matched=false
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 3 of 9 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
DEBUG [http-8080-2] (FilterChainProxy.java:195) - Converted URL to lowercase, from: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'; to: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 4 of 9 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
DEBUG [http-8080-3] (FilterChainProxy.java:195) - Converted URL to lowercase, from: '/faces/javax.faces.resource/combined.css'; to: '/faces/javax.faces.resource/combined.css'
DEBUG [http-8080-5] (DefaultSavedRequest.java:336) - pathInfo: arg1=/javax.faces.resource/compat.js; arg2=/login.xhtml (property not equals)
DEBUG [http-8080-2] (FilterChainProxy.java:202) - Candidate is: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'; pattern is /**; matched=true
DEBUG [http-8080-5] (HttpSessionRequestCache.java:72) - saved request doesn't match
DEBUG [http-8080-3] (FilterChainProxy.java:202) - Candidate is: '/faces/javax.faces.resource/combined.css'; pattern is /**; matched=true
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 5 of 9 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
DEBUG [http-8080-2] (FilterChainProxy.java:375) - /faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css?ln=yui/2in3 at position 1 of 9 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 6 of 9 in additional filter chain; firing Filter: 'RememberMeAuthenticationFilter'
DEBUG [http-8080-3] (FilterChainProxy.java:375) - /faces/javax.faces.resource/combined.css?ln=org.icefaces.component.util at position 1 of 9 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 7 of 9 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
DEBUG [http-8080-2] (HttpSessionSecurityContextRepository.java:142) - HttpSession returned null object for SPRING_SECURITY_CONTEXT
DEBUG [http-8080-5] (AnonymousAuthenticationFilter.java:67) - Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@9057bc48: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: A5721C800637CFCD4F6EF9E512468F64; Granted Authorities: ROLE_ANONYMOUS'
DEBUG [http-8080-3] (HttpSessionSecurityContextRepository.java:142) - HttpSession returned null object for SPRING_SECURITY_CONTEXT
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 8 of 9 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
DEBUG [http-8080-5] (FilterChainProxy.java:375) - /faces/login.xhtml at position 9 of 9 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
DEBUG [http-8080-2] (HttpSessionSecurityContextRepository.java:88) - No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade@118eb00c. A new one will be created.
DEBUG [http-8080-5] (DefaultFilterInvocationSecurityMetadataSource.java:173) - Converted URL to lowercase, from: '/faces/login.xhtml'; to: '/faces/login.xhtml'
DEBUG [http-8080-3] (HttpSessionSecurityContextRepository.java:88) - No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade@118eb00c. A new one will be created.
DEBUG [http-8080-5] (DefaultFilterInvocationSecurityMetadataSource.java:200) - Candidate is: '/faces/login.xhtml'; pattern is /faces/login.xhtml; matched=true
DEBUG [http-8080-2] (FilterChainProxy.java:375) - /faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css?ln=yui/2in3 at position 2 of 9 in additional filter chain; firing Filter: 'LogoutFilter'
DEBUG [http-8080-5] (AbstractSecurityInterceptor.java:191) - Secure object: FilterInvocation: URL: /faces/login.xhtml; Attributes: [permitAll]
DEBUG [http-8080-3] (FilterChainProxy.java:375) - /faces/javax.faces.resource/combined.css?ln=org.icefaces.component.util at position 2 of 9 in additional filter chain; firing Filter: 'LogoutFilter'
DEBUG [http-8080-5] (AbstractSecurityInterceptor.java:292) - Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9057bc48: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: A5721C800637CFCD4F6EF9E512468F64; Granted Authorities: ROLE_ANONYMOUS
DEBUG [http-8080-2] (FilterChainProxy.java:375) - /faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css?ln=yui/2in3 at position 3 of 9 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
DEBUG [http-8080-5] (AffirmativeBased.java:53) - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@20688e91, returned: 1
DEBUG [http-8080-3] (FilterChainProxy.java:375) - /faces/javax.faces.resource/combined.css?ln=org.icefaces.component.util at position 3 of 9 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
DEBUG [http-8080-5] (AbstractSecurityInterceptor.java:213) - Authorization successful
DEBUG [http-8080-2] (FilterChainProxy.java:375) - /faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css?ln=yui/2in3 at position 4 of 9 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
DEBUG [http-8080-5] (AbstractSecurityInterceptor.java:223) - RunAsManager did not change Authentication object
DEBUG [http-8080-3] (FilterChainProxy.java:375) - /faces/javax.faces.resource/combined.css?ln=org.icefaces.component.util at position 4 of 9 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
DEBUG [http-8080-5] (FilterChainProxy.java:362) - /faces/login.xhtml reached end of additional filter chain; proceeding with original chain
DEBUG [http-8080-2] (DefaultSavedRequest.java:336) - pathInfo: arg1=/javax.faces.resource/compat.js; arg2=/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css (property not equals)
DEBUG [http-8080-2] (HttpSessionRequestCache.java:72) - saved request doesn't match
DEBUG [http-8080-3] (DefaultSavedRequest.java:336) - pathInfo: arg1=/javax.faces.resource/compat.js; arg2=/javax.faces.resource/combined.css (property not equals)
DEBUG [http-8080-3] (HttpSessionRequestCache.java:72) - saved request doesn't match
DEBUG [http-8080-2] (FilterChainProxy.java:375) - /faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css?ln=yui/2in3 at position 5 of 9 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
DEBUG [http-8080-3] (FilterChainProxy.java:375) - /faces/javax.faces.resource/combined.css?ln=org.icefaces.component.util at position 5 of 9 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
DEBUG [http-8080-2] (FilterChainProxy.java:375) - /faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css?ln=yui/2in3 at position 6 of 9 in additional filter chain; firing Filter: 'RememberMeAuthenticationFilter'
DEBUG [http-8080-3] (FilterChainProxy.java:375) - /faces/javax.faces.resource/combined.css?ln=org.icefaces.component.util at position 6 of 9 in additional filter chain; firing Filter: 'RememberMeAuthenticationFilter'
DEBUG [http-8080-2] (FilterChainProxy.java:375) - /faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css?ln=yui/2in3 at position 7 of 9 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
DEBUG [http-8080-3] (FilterChainProxy.java:375) - /faces/javax.faces.resource/combined.css?ln=org.icefaces.component.util at position 7 of 9 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
DEBUG [http-8080-2] (AnonymousAuthenticationFilter.java:67) - Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@9057bc48: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: A5721C800637CFCD4F6EF9E512468F64; Granted Authorities: ROLE_ANONYMOUS'
DEBUG [http-8080-2] (FilterChainProxy.java:375) - /faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css?ln=yui/2in3 at position 8 of 9 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
DEBUG [http-8080-2] (FilterChainProxy.java:375) - /faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css?ln=yui/2in3 at position 9 of 9 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
DEBUG [http-8080-3] (AnonymousAuthenticationFilter.java:67) - Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@9057bc48: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: A5721C800637CFCD4F6EF9E512468F64; Granted Authorities: ROLE_ANONYMOUS'
DEBUG [http-8080-2] (DefaultFilterInvocationSecurityMetadataSource.java:173) - Converted URL to lowercase, from: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'; to: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'
DEBUG [http-8080-3] (FilterChainProxy.java:375) - /faces/javax.faces.resource/combined.css?ln=org.icefaces.component.util at position 8 of 9 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
DEBUG [http-8080-2] (DefaultFilterInvocationSecurityMetadataSource.java:200) - Candidate is: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'; pattern is /faces/login.xhtml; matched=false
DEBUG [http-8080-3] (FilterChainProxy.java:375) - /faces/javax.faces.resource/combined.css?ln=org.icefaces.component.util at position 9 of 9 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
DEBUG [http-8080-2] (DefaultFilterInvocationSecurityMetadataSource.java:200) - Candidate is: '/faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css'; pattern is /faces/**; matched=true
DEBUG [http-8080-3] (DefaultFilterInvocationSecurityMetadataSource.java:173) - Converted URL to lowercase, from: '/faces/javax.faces.resource/combined.css'; to: '/faces/javax.faces.resource/combined.css'
DEBUG [http-8080-2] (AbstractSecurityInterceptor.java:191) - Secure object: FilterInvocation: URL: /faces/javax.faces.resource/yui2-skin-sam-button/assets/button-core.css?ln=yui/2in3; Attributes: [isAuthenticated()]
DEBUG [http-8080-3] (DefaultFilterInvocationSecurityMetadataSource.java:200) - Candidate is: '/faces/javax.faces.resource/combined.css'; pattern is /faces/login.xhtml; matched=false
DEBUG [http-8080-3] (DefaultFilterInvocationSecurityMetadataSource.java:200) - Candidate is: '/faces/javax.faces.resource/combined.css'; pattern is /faces/**; matched=true
DEBUG [http-8080-3] (AbstractSecurityInterceptor.java:191) - Secure object: FilterInvocation: URL: /faces/javax.faces.resource/combined.css?ln=org.icefaces.component.util; Attributes: [isAuthenticated()]
DEBUG [http-8080-3] (AbstractSecurityInterceptor.java:292) - Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9057bc48: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: A5721C800637CFCD4F6EF9E512468F64; Granted Authorities: ROLE_ANONYMOUS
DEBUG [http-8080-3] (AffirmativeBased.java:53) - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@20688e91, returned: -1
DEBUG [http-8080-3] (ExceptionTranslationFilter.java:153) - Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
    at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:71)
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:203)
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:106)
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:83)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:97)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
    at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:78)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
    at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:112)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
    at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
    at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:35)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:187)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:79)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:169)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:291)
    at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
    at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:602)
    at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
    at java.lang.Thread.run(Thread.java:619)

You have to define that the login Page itself is accessible without login.

<security:intercept-url pattern="/faces/login.xhtml" access="permitAll" />

And put this line before the "catch all" line:

<intercept-url pattern="/faces/**" access="isAuthenticated()" />

The reference document says urls are matched in the same order as declared!

Difference between access and filter attribute -- You need to knwo that spring security have a complete filter chain, and the accessDesisionFilter is only one of them. (This complete filter chain in initiated by <security:http auto="true">

Using filters="none" operates by creating an empty filter chain in Spring Security's FilterChainProxy, whereas the access attributes are used to configure the FilterSecurityInterceptor in the single filter chain which is created by the namespace configuration. The two are applied independently, so if you have an access contraint for a sub-pattern of a pattern which has a filters="none" attribute, the access constraint will be ignored, even if it is listed first. It isn't possible to apply a filters="none" attribute to the pattern /** since this is used by the namespace filter chain. In version 3.1 things are more flexible. You can define multiple filter chains and the filters attribute is no longer supported.