I have configured a form-base authentication using Spring security. It works fine when I log in using the login form in my web application.
It also works with cURL:
Using http.httpBasic worked for me.
http.httpBasic() .and() .authorizeRequests() .antMatchers("/api/home") .hasRole("ADMIN") .antMatchers("/api/product/*") .hasRole("ADMIN") .and() .formLogin();