EL1008E:(pos 8):Property or field cannot be found on object of type '...security.web.access.expression.WebSecurityExpressionRoot' maybe not public?

Add '' to Role..

<intercept-url pattern="/admin*" access="hasRole('ROLE_ADMIN')" />

then it will evaluate the expression.

For this simple example, in order to avoid those single quotes (') an alternative could be to disable using expressions by changing the value of use-expressions to false. So your config should look like:

<http auto-config="true" use-expressions="false">
    <intercept-url pattern="/admin*" access="ROLE_ADMIN" />
    <logout logout-success-url="/admin" />
</http>