你有几次错别字。第一行intercept-url行缺少ROLE_ADMIN周围的单引号，第二行缺少hasRole。它应该是
<http auto-config="true" use-expressions="true"> <intercept-url pattern=".*admin.htm" access="hasRole('ROLE_ADMIN')" /> <intercept-url pattern="/siteadmin/*.htm" access="hasRole('ROLE_ADMIN')" /> <intercept-url pattern="/siteadmin/cleancache.htm" access="hasRole('ROLE_ADMIN')" />
