Sping Security как работает авторизация

@RequestMapping(value = "login", method = RequestMethod.GET)
public String getLoginPage(Model model){
return"login";
}

@Autowired
UserDetailsService userDetailsService;
 
@Autowired
public void configAuthentication(AuthenticationManagerBuilder auth)throws Exception{
        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
        }
 
@Bean(name = "passwordEncoder")
public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
        }
@Override
protected void configure(HttpSecurity http)throws Exception{
        http.authorizeRequests()
        .antMatchers("/map/rest/hello/**").access("hasRole('ADMIN')")
        .antMatchers("/confidential/**").access("hasRole('SUPERADMIN')")
        .and().formLogin().loginPage("/login").permitAll().
        defaultSuccessUrl("/",false)
        .and().csrf().disable().
        sessionManagement().maximumSessions(1).sessionRegistry(sessionRegistry()).and().and()
        .logout().
        logoutUrl("/logout").logoutSuccessUrl("/").
        invalidateHttpSession(true).deleteCookies();
        }
@Bean
public UserDetailsService userDetailsService(){
        JdbcDaoImpl jdbcImpl=new JdbcDaoImpl();
        jdbcImpl.setDataSource(hibernateConfig.dataSource());
        jdbcImpl.setUsersByUsernameQuery(environment.getRequiredProperty("usersByQuery"));
        jdbcImpl.setAuthoritiesByUsernameQuery(environment.getRequiredProperty("rolesByQuery"));
        return jdbcImpl;
        }