...
If custom security is required first of all is to define own global authentication via GlobalAuthenticationConfigurerAdapter (see GlobalSecurityConfig). Probably you will use #init(AuthenticationManagerBuilder) method to define authentication manager (manager of users and their roles).
...