public class CustomConfigurationProvider implements ConfigurationBuilderProvider { @Override public HTTPConfigurationBuilder getBuilder(ServletContext context) { HTTPConfigurationBuilder configurationBuilder = new HTTPConfigurationBuilder(); // protected resources configuration configurationBuilder.protectedResource() // unprotected resource. Usually this will be your application's static resources like CSS, JS, etc. .resource("/resources/*", ProtectedResourceConstraint.NOT_PROTECTED) // the login page is marked as not protected. .resource("/login.jsp", ProtectedResourceConstraint.NOT_PROTECTED) // the register page is marked as not protected. .resource("/signup.jsp", ProtectedResourceConstraint.NOT_PROTECTED) // the register page is marked as not protected. .resource("/signup", ProtectedResourceConstraint.NOT_PROTECTED) // the error page is marked as not protected. .resource("/error.jsp", ProtectedResourceConstraint.NOT_PROTECTED) // protected all resources. They will be available only for users with a role named 'guest'. .resource("/*", "guest"); return configurationBuilder; } }