<set name="userGroups"
             inverse="true"
             access="field">
          <key column="user_id"/>
          <one-to-many class="UserGroup"/>
        </set>

       <class name="UserGroup" table="user_group" mutable="false">
      <composite-id name="id" class="UserGroup$Id">
        <key-property name="userId"  column="user_id"/>
        <key-property name="groupId" column="group_id"/>
      </composite-id>
       <many-to-one
           name="user"
           column="user_id"
           not-null="true"
           insert="false"
           update="false"
           access="field"/>
       <many-to-one
           name="group"
           column="group_id"
           not-null="true"
           insert="false"
           update="false"
           access="field"/>
  </class>

@Override
    public GrantedAuthority[] getAuthorities()
    {
        Collection<Group> authorities = new HashSet<Group>();
        for (UserGroup userGroup : getUserGroups())
        {
            authorities.add(userGroup.getGroup());
        }
        return authorities.toArray(new GrantedAuthority[0]);
    }

org.hibernate.LazyInitializationException: failed to lazily initialize a collection of role: myproject.util.security.domain.User.userGroups, no session or session was closed
   org.hibernate.collection.AbstractPersistentCollection.throwLazyInitializationException(AbstractPersistentCollection.java:358)
   org.hibernate.collection.AbstractPersistentCollection.throwLazyInitializationExceptionIfNotConnected(AbstractPersistentCollection.java:350)
   org.hibernate.collection.AbstractPersistentCollection.initialize(AbstractPersistentCollection.java:343)
   org.hibernate.collection.AbstractPersistentCollection.read(AbstractPersistentCollection.java:86)
   org.hibernate.collection.PersistentSet.iterator(PersistentSet.java:163)
   myproject.util.security.domain.User.getAuthorities(User.java:160)
   org.springframework.security.providers.dao.AbstractUserDetailsAuthenticationProvider.createSuccessAuthentication(AbstractUserDetailsAuthenticationProvider.java:183)
   org.springframework.security.providers.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:162)
   org.springframework.security.providers.ProviderManager.doAuthentication(ProviderManager.java:195)
   org.springframework.security.AbstractAuthenticationManager.authenticate(AbstractAuthenticationManager.java:46)
   org.springframework.security.ui.webapp.AuthenticationProcessingFilter.attemptAuthentication(AuthenticationProcessingFilter.java:81)
   org.springframework.security.ui.AbstractProcessingFilter.doFilterHttp(AbstractProcessingFilter.java:249)
   org.springframework.security.ui.SpringSecurityFilter.doFilter(SpringSecurityFilter.java:53)
   org.springframework.security.config.OrderedFilterBeanDefinitionDecorator$OrderedFilterDecorator.doFilter(OrderedFilterBeanDefinitionDecorator.java:93)
   org.springframework.security.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:371)
   org.springframework.security.ui.logout.LogoutFilter.doFilterHttp(LogoutFilter.java:87)
   org.springframework.security.ui.SpringSecurityFilter.doFilter(SpringSecurityFilter.java:53)
   org.springframework.security.config.OrderedFilterBeanDefinitionDecorator$OrderedFilterDecorator.doFilter(OrderedFilterBeanDefinitionDecorator.java:93)
   org.springframework.security.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:371)
   org.springframework.security.context.HttpSessionContextIntegrationFilter.doFilterHttp(HttpSessionContextIntegrationFilter.java:229)
   org.springframework.security.ui.SpringSecurityFilter.doFilter(SpringSecurityFilter.java:53)
   org.springframework.security.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:371)
   org.springframework.security.concurrent.ConcurrentSessionFilter.doFilterHttp(ConcurrentSessionFilter.java:97)
   org.springframework.security.ui.SpringSecurityFilter.doFilter(SpringSecurityFilter.java:53)
   org.springframework.security.config.OrderedFilterBeanDefinitionDecorator$OrderedFilterDecorator.doFilter(OrderedFilterBeanDefinitionDecorator.java:93)
   org.springframework.security.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:371)
   org.springframework.security.securechannel.ChannelProcessingFilter.doFilterHttp(ChannelProcessingFilter.java:116)
   org.springframework.security.ui.SpringSecurityFilter.doFilter(SpringSecurityFilter.java:53)
   org.springframework.security.config.OrderedFilterBeanDefinitionDecorator$OrderedFilterDecorator.doFilter(OrderedFilterBeanDefinitionDecorator.java:93)
   org.springframework.security.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:371)
   org.springframework.security.util.FilterChainProxy.doFilter(FilterChainProxy.java:174)
   org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:183)
   org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:138)

<bean id="securitySessionInViewInterceptor"
        class="org.springframework.orm.hibernate3.support.OpenSessionInViewInterceptor">
        <property name="sessionFactory">
            <ref bean="exampleSessionFactory"/>
        </property>
        <property name="flushModeName" value="FLUSH_AUTO"/>
    </bean>


<!--  url mapping  -->
    <bean id="simpleUrlMapping"
        class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping">
        <property name="interceptors">
            <list>
                <ref bean="securitySessionInViewInterceptor" />
            </list>
        </property>
        <property name="alwaysUseFullPath">
            <value>false</value>
        </property>
        <property name="mappings">
            <props>
                <prop key="/index.htm">welcomeController</prop>
                <prop key="/group.htm">groupController</prop>
                <prop key="/application.htm">applicationController</prop>
                <prop key="${loginFormUrl}">loginController</prop>
                <prop key="${authenticationFailureUrl}">loginErrorController</prop>
                <prop key="${logoutUrl}">logoutController</prop>
                <prop key="${accessDeniedUrl}">accessdeniedController</prop>
                <prop key="${sessionExpireUrl}">sessionExceededController</prop>
                <prop key="${defaultUrl}">generalController</prop>
            </props>
        </property>
    </bean>