questo è uno stralcio preso direttamente dal codice (funzionante) cui ho lavorato io

security.xml
codice:
   <authentication-provider user-service-ref="userDao">
        <password-encoder ref="passwordEncoder"/>
    </authentication-provider>
application-context.xml
codice:
 <bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource" destroy-method="close">

        <property name="driverClassName" value="${jdbc.driverClassName}"/>

        <property name="url" value="${jdbc.url}"/>

        <property name="username" value="${jdbc.username}"/>

        <property name="password" value="${jdbc.password}"/>

        <property name="maxActive" value="30"/>

        <property name="maxIdle" value="10"/>

        <property name="maxWait" value="1000"/>

        <property name="defaultAutoCommit" value="true"/>

    </bean>
    <bean id="sqlMapClient" class="org.springframework.orm.ibatis.SqlMapClientFactoryBean">

        <property name="dataSource" ref="dataSource"/>

        <property name="configLocation" value="classpath:/sql-map-config.xml"/>

    </bean>
  <bean id="userDao" class="com.yourcompany.UserDaoImpl">


        <property name="sqlMapClient" ref="sqlMapClient"/>

    </bean>
dove UserDaoImpl deve essere il tuo dao ed implementare org.springframework.security.userdetails.UserDetai lsService