Multi session in spring security 3.1 - spring-security

Question

We develop a web application that need different authentication, in my case this is agent and member. This is the detail:
Agent profile page is at http://my.local/spring-security-hello-world/agent/profile
Member profile page is at http://my.local/spring-security-hello-world/member/profile
Both of pages are filtered by springSecurityFilterChain
But i have some issues here. First I login at agent profile page, and successfully logged in. But then I open the member page, and I got HTTP Status 403 - Access is denied. The situation i want to achieve is both agent and member is able to logged in.
Here is my web.xml
<?xml version="1.0" encoding="UTF-8"?><web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
id="WebApp_ID" version="2.5">
<display-name>spring-security-hello-world</display-name>
<welcome-file-list>
<welcome-file>index.html</welcome-file>
<welcome-file>index.htm</welcome-file>
<welcome-file>index.jsp</welcome-file>
<welcome-file>default.html</welcome-file>
<welcome-file>default.htm</welcome-file>
<welcome-file>default.jsp</welcome-file>
</welcome-file-list>
<servlet>
<servlet-name>mvc-dispatcher</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>mvc-dispatcher</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/mvc-dispatcher-servlet.xml,
/WEB-INF/spring-security.xml
</param-value>
</context-param>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
And this is my spring-security.xml
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security.xsd">
<!-- <http pattern="/agent/login" security="none" /> -->
<http pattern="/member/**">
<intercept-url pattern="/**" access="ROLE_MEMBER" />
<form-login login-page="/member_login" default-target-url="/member/profile"
authentication-failure-url="/member_loginfailed" />
<logout logout-success-url="/member_logout" />
</http>
<http auto-config="true">
<intercept-url pattern="/agent/**" access="ROLE_AGENT" />
<form-login login-page="/agent_login" default-target-url="/agent/profile"
authentication-failure-url="/agent_loginfailed" />
<logout logout-success-url="/agent_logout" />
</http>
<authentication-manager>
<authentication-provider>
<user-service>
<user name="agent" password="123456" authorities="ROLE_AGENT" />
</user-service>
</authentication-provider>
<authentication-provider>
<user-service>
<user name="member" password="123456" authorities="ROLE_MEMBER" />
</user-service>
</authentication-provider>
</authentication-manager>
Notes:
In my case one user must only have one role (either agent or member only)

Answer 1

If you do it in the same browser then your Agent with ROLE_AGENT is used to access page which is restricted to ROLE_MEMBER. You can add ROLE_MEMBER to your access="ROLE_AGENT, ROLE_MEMBER" to check it.