Apache Shiro 1.4.0 initialization

Question

I installed Apache Shiro 1.4.0 and was following this official tutorial in order to set it up.

When I tried to initialize SecurityUtils with SecurityManager using this code from tutorial:

Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");
SecurityManager securityManager = factory.getInstance();
SecurityUtils.setSecurityManager(securityManager);

I got a message that IniSecurityManagerFactory is deprecated now in favor of Shiro's Environment.

I can't find any tutorial that shows how to initialize Shiro using Environment, and its documentation doesn't help much:

An Environment instance encapsulates all of the objects that Shiro requires to function. It is essentially a 'meta' object from which all Shiro components can be obtained for an application.

An Environment instance is usually created as a result of parsing a Shiro configuration file. The environment instance can be stored in any place the application deems necessary, and from it, can retrieve any of Shiro's components that might be necessary in implementing security behavior.

For example, the most obvious component accessible via an Environment instance is the application's securityManager.

So, how do I use this new initialization mechanism?

Answer 1

As of Shiro 1.5 there is now BasicIniEnvironment. Its Javadoc suggests to create the SecurityManager like this:

Environment env = new BasicIniEnvironment("classpath:shiro.ini");
SecurityManager securityManager = env.getSecurityManager();

You can then continue:

SecurityUtils.setSecurityManager(securityManager);

That being said, I think when using Shiro in a standard web application, I think one shouldn't be doing this on one's own, but instead configure the EnvironmentLoaderListener in the web.xml file:

<listener>
    <listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
</listener>

According to the Javadoc this will use the EnvrionmentLoader and load the configuration from a shiro.ini by looking at the following locations:

1. /WEB-INF/shiro.ini
2. classpath:shiro.ini

Thus one can simply put the shiro.ini on the classpath, add Shiro will pick the config up itself.