try below code. it worked for me.
http
.csrf().disable()
.authorizeRequests()
.antMatchers("/login**", "/").permitAll()
.antMatchers("/user/**").access("hasAnyAuthority('USER')")
.antMatchers("/admin/**").access("hasAnyAuthority('ADMIN')")
.anyRequest().fullyAuthenticated()
.and()
.formLogin();