login authentication filter java struts

Question

i have a question. How to filter multiple user for login in java struts?

here is my code

LoginFilter.java

public class LoginFilter implements Filter {

    private FilterConfig config = null;

    public void destroy() {
        // TODO Auto-generated method stub
        config = null;
    }

    public void doFilter(ServletRequest request, ServletResponse response,
        FilterChain chain) throws IOException, ServletException {
        // TODO Auto-generated method stub
        HttpServletRequest req = (HttpServletRequest)request;
        HttpSession session = req.getSession(true);

        String cek;
        if(session.getAttribute("idNasabah") != null){
            cek = session.getAttribute("idNasabah").toString();
        }else if(session.getAttribute("idStaff")!= null){
            cek = session.getAttribute("idStaff").toString();
        }else{
            cek = null;
        }

        if(cek== null){
            req.getRequestDispatcher("login.do").forward(request, response);
        }else{
            chain.doFilter(request, response);
        }
    }

    public void init(FilterConfig config) throws ServletException {
        // TODO Auto-generated method stub
        this.config = config;
    }

}

and here is the web.xml

<filter>
    <filter-name>LoginFilter</filter-name>
    <filter-class>filter.LoginFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>LoginFilter</filter-name>
    <servlet-name>action</servlet-name>
</filter-mapping>
<servlet>
    <servlet-name>action</servlet-name>
    <servlet-class>org.apache.struts.action.ActionServlet</servlet-class>
    <init-param>
        <param-name>config</param-name>
        <param-value>/WEB-INF/struts-config.xml</param-value>
    </init-param>
    <init-param>
        <param-name>debug</param-name>
        <param-value>2</param-value>
    </init-param>
    <load-on-startup>2</load-on-startup>
</servlet>
<servlet-mapping>
    <servlet-name>action</servlet-name>
    <url-pattern>*.do</url-pattern>
</servlet-mapping>
</web-app>

How to differentiate a role (admin and user). Differentiating pages that can be accessed by the admin and user. because with my code, can only filter if not logged in, while still able to access the admin user directly. For example, I logged in to the admin, then I can still access

/InternetBanking/pembayaranKartuKredit.do?task=CreditCard

anyone can help? thaks :)