Hi,
After getting a working 'proof of concept' (POC) of SpringMVC on GAE, I managed to have a POC of GAE and Spring Security. After playing around, reading every tutorial I could find by googling (they are only a few) and struggling with errors for some days, I got it working locally.

In the application I have a simple controller having this code:
Java Code: 
package example.controllers.hello;

import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;

@Controller
public class HelloController {

	@RequestMapping("/hello/{name}")
	public String hello(@PathVariable String name, Model model) {
		model.addAttribute("name", name);
		return "hello/hello";
	}
}
also I've a hellp.jsp:
Java Code: 
Hello, <%= request.getAttribute("name") %>!
When I "run as web application" under Eclipse, I first have a choice of Servlets, then I click on HelloController, just after that I'll be redirected to a login page as expected, I enter usr/pwd and then I'll be welcomed by "Hello, world!" from the hello.jsp. All seems ok. After I deployed it here:
Hello App Engine

as you can see and try by yourself, I also get to the login page, but here if I enter the right usr/pwd I'll be no more redirected to the hello-world page! If I enter wrong usr/pwd, I'll be informed and this means 'some' of the program is working correct! I checked my log on app engine and it does not contain any useful information, as there are no errors/warnings informed! So what could be reason please?

I provide the content of my both xml files (all other files are standard and these also at POC level):

web.xml:
Java Code: 
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE web-app PUBLIC
 "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
 "http://java.sun.com/dtd/web-app_2_3.dtd">

<web-app xmlns="http://java.sun.com/xml/ns/javaee" version="2.5">

	<listener>
		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	</listener>

	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>
				/WEB-INF/applicationContext-security.xml
		</param-value>
	</context-param>
<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
	
	<servlet>
		<servlet-name>dispatcher</servlet-name>
		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
		<load-on-startup>1</load-on-startup>
		<!-- 
		Note about load-on-startup: the load actually occurs during the first request handled by the web server instance, not prior to it.
		(from http://code.google.com/appengine/docs/java/config/webxml.html#web_xml_Features_Not_Supported)
		 -->
	</servlet>
	<servlet-mapping>
		<servlet-name>dispatcher</servlet-name>
		<url-pattern>/a/*</url-pattern>
	</servlet-mapping>

	<servlet>
		<servlet-name>springexample</servlet-name>
		<servlet-class>example.SpringExampleServlet</servlet-class>
	</servlet>
	<servlet-mapping>
		<servlet-name>springexample</servlet-name>
		<url-pattern>/springexample</url-pattern>
	</servlet-mapping>
</web-app>
applicatonContext-security.xml:
Java Code: 
<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">

    <http use-expressions="true">
        <intercept-url pattern="/" access="permitAll"/>
        <intercept-url pattern="/**" access="isAuthenticated()" />
        <form-login />
        <logout />
    </http>

	<!--bvgggggggggg4er45 Usernames/Passwords are rod/koala dianne/emu scott/wombat 
		peter/opal -->
    <authentication-manager>
        <authentication-provider>
            <password-encoder hash="md5"/>
            <user-service>
                <user name="rod" password="a564de63c2d0da68cf47586ee05984d7" authorities="ROLE_SUPERVISOR, ROLE_USER, ROLE_TELLER" />
                <user name="dianne" password="65d15fe9156f9c4bbffd98085992a44e" authorities="ROLE_USER,ROLE_TELLER" />
                <user name="scott" password="2b58af6dddbd072ed27ffc86725d7d3a" authorities="ROLE_USER" />
                <user name="peter" password="22b5c9accc6e1ba628cedc63a72d57f8" authorities="ROLE_USER" />
            </user-service>
        </authentication-provider>
    </authentication-manager>

</beans:beans>