diff --git a/assembly/broker/configurations/shiro.ini b/assembly/broker/configurations/shiro.ini
index 8fe38b094c1..0972c7a5a43 100644
--- a/assembly/broker/configurations/shiro.ini
+++ b/assembly/broker/configurations/shiro.ini
@@ -3,70 +3,25 @@
# =======================
[main]
-# Objects and their properties are defined here,
-# Such as the securityManager, Realms and anything
-# else needed to build the SecurityManager
-#authenticator
+# Authenticator
authenticator = org.eclipse.kapua.service.authentication.shiro.KapuaAuthenticator
securityManager.authenticator = $authenticator
-#
-# Auth filters
-# kapuaAuthcAccessToken = org.eclipse.kapua.app.api.auth.KapuaTokenAuthenticationFilter
-
-#cacheManager = org.eclipse.kapua.broker.core.experimental.CacheManager
-#securityManager.cacheManager = $cacheManager
-
-##########
-# Realms #
-##########
-# Login
+# Realms
kapuaUserPassAuthenticatingRealm = org.eclipse.kapua.service.authentication.shiro.realm.UserPassAuthenticatingRealm
-# Session
-kapuaAccessTokenAuthenticatingRealm = org.eclipse.kapua.service.authentication.shiro.realm.AccessTokenAuthenticatingRealm
-
-########################
-#Authorization section #
-########################
# Authorization
kapuaAuthorizingRealm = org.eclipse.kapua.service.authorization.shiro.KapuaAuthorizingRealm
-#removed from realms the authorizing realm (kapuaAuthorizingRealm) since it will be defined into the new Authorizer component
securityManager.realms = $kapuaUserPassAuthenticatingRealm
+# Authorizer
authorizer = org.eclipse.kapua.broker.core.security.EnhModularRealmAuthorizer
-#realms must be set again otherwise the authorizer will not have any.
-#The security manager (AuthorizingSecurityManager) is built in this way:
-# AuthorizingSecurityManager() //constructor
-# setRealms(realms) //set realms (if any)
-# afterRealmsSet() //set realms to authenticator (if any)
-# setAuthorizer(Authorizer authorizer) //if any configured
-# setAuthenticator() //if any custom authenticator is set
-#In this way the new authenticator must have the realms already configured once is set to the security manager.
-#Otherwise the security manager doesn't set it's own security manager to the authenticator
authorizer.realms = $kapuaAuthorizingRealm
securityManager.authorizer = $authorizer
-# SessionListeners only works with in the native SessionMode
-# This is not the mode we use when running in Tomcat.
-#securityManager.sessionMode = native
+# Session
securityManager.sessionManager.globalSessionTimeout = -1
securityManager.sessionManager.sessionValidationSchedulerEnabled = false
-securityManager.subjectDAO.sessionStorageEvaluator.sessionStorageEnabled = false
-
-[users]
-# The 'users' section is for simple deployments
-# when you only need a small number of statically-defined
-# set of User accounts.
-
-[roles]
-# The 'roles' section is for simple deployments
-# when you only need a small number of statically-defined
-# roles.
-
-[urls]
-# The 'urls' section is used for url-based security
-# in web applications. We'll discuss this section in the
-# Web documentation
+securityManager.subjectDAO.sessionStorageEvaluator.sessionStorageEnabled = false
\ No newline at end of file
diff --git a/console/web/src/main/resources/shiro.ini b/console/web/src/main/resources/shiro.ini
index 1fc83a40d16..3e82d9bd662 100644
--- a/console/web/src/main/resources/shiro.ini
+++ b/console/web/src/main/resources/shiro.ini
@@ -3,31 +3,17 @@
# =======================
[main]
-# Objects and their properties are defined here,
-# Such as the securityManager, Realms and anything
-# else needed to build the SecurityManager
-#authenticator
+# Authenticator
authenticator = org.eclipse.kapua.service.authentication.shiro.KapuaAuthenticator
securityManager.authenticator = $authenticator
-#realms
+# Realms
kapuaAuthenticatingRealm = org.eclipse.kapua.service.authentication.shiro.realm.UserPassAuthenticatingRealm
kapuaAuthorizingRealm = org.eclipse.kapua.service.authorization.shiro.KapuaAuthorizingRealm
jwtAuthenticatingRealm = org.eclipse.kapua.service.authentication.shiro.realm.JwtAuthenticatingRealm
-securityManager.realms = $kapuaAuthorizingRealm, $kapuaAuthenticatingRealm, $jwtAuthenticatingRealm
-
-[users]
-# The 'users' section is for simple deployments
-# when you only need a small number of statically-defined
-# set of User accounts.
-[roles]
-# The 'roles' section is for simple deployments
-# when you only need a small number of statically-defined
-# roles.
+securityManager.realms = $kapuaAuthorizingRealm, $kapuaAuthenticatingRealm, $jwtAuthenticatingRealm
-[urls]
-# The 'urls' section is used for url-based security
-# in web applications. We'll discuss this section in the
-# Web documentation
+# Request Filtering
+filterChainResolver = org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver
\ No newline at end of file
diff --git a/qa/integration/src/test/resources/shiro.ini b/qa/integration/src/test/resources/shiro.ini
index 243eb7d95a2..fc7e70b51d8 100644
--- a/qa/integration/src/test/resources/shiro.ini
+++ b/qa/integration/src/test/resources/shiro.ini
@@ -3,70 +3,31 @@
# =======================
[main]
-# Objects and their properties are defined here,
-# Such as the securityManager, Realms and anything
-# else needed to build the SecurityManager
-#authenticator
+# Authenticator
authenticator = org.eclipse.kapua.service.authentication.shiro.KapuaAuthenticator
securityManager.authenticator = $authenticator
-#
-# Auth filters
-# kapuaAuthcAccessToken = org.eclipse.kapua.app.api.auth.KapuaTokenAuthenticationFilter
-
-#cacheManager = org.eclipse.kapua.broker.core.experimental.CacheManager
-#securityManager.cacheManager = $cacheManager
-
##########
# Realms #
##########
+
# Login
kapuaUserPassAuthenticatingRealm = org.eclipse.kapua.service.authentication.shiro.realm.UserPassAuthenticatingRealm
# Session
kapuaAccessTokenAuthenticatingRealm = org.eclipse.kapua.service.authentication.shiro.realm.AccessTokenAuthenticatingRealm
-########################
-#Authorization section #
-########################
# Authorization
kapuaAuthorizingRealm = org.eclipse.kapua.service.authorization.shiro.KapuaAuthorizingRealm
-#removed from realms the authorizing realm (kapuaAuthorizingRealm) since it will be defined into the new Authorizer component
+
securityManager.realms = $kapuaAccessTokenAuthenticatingRealm, $kapuaUserPassAuthenticatingRealm
+# Authorizer
authorizer = org.eclipse.kapua.broker.core.security.EnhModularRealmAuthorizer
-#realms must be set again otherwise the authorizer will not have any.
-#The security manager (AuthorizingSecurityManager) is built in this way:
-# AuthorizingSecurityManager() //constructor
-# setRealms(realms) //set realms (if any)
-# afterRealmsSet() //set realms to authenticator (if any)
-# setAuthorizer(Authorizer authorizer) //if any configured
-# setAuthenticator() //if any custom authenticator is set
-#In this way the new authenticator must have the realms already configured once is set to the security manager.
-#Otherwise the security manager doesn't set it's own security manager to the authenticator
authorizer.realms = $kapuaAuthorizingRealm
securityManager.authorizer = $authorizer
-# SessionListeners only works with in the native SessionMode
-# This is not the mode we use when running in Tomcat.
-#securityManager.sessionMode = native
+# Session
securityManager.sessionManager.globalSessionTimeout = -1
-securityManager.sessionManager.sessionValidationSchedulerEnabled = false
-
-securityManager.subjectDAO.sessionStorageEvaluator.sessionStorageEnabled = false
-
-[users]
-# The 'users' section is for simple deployments
-# when you only need a small number of statically-defined
-# set of User accounts.
-
-[roles]
-# The 'roles' section is for simple deployments
-# when you only need a small number of statically-defined
-# roles.
-
-[urls]
-# The 'urls' section is used for url-based security
-# in web applications. We'll discuss this section in the
-# Web documentation
+securityManager.sessionManager.sessionValidationSchedulerEnabled = false
\ No newline at end of file
diff --git a/rest-api/web/src/main/resources/shiro.ini b/rest-api/web/src/main/resources/shiro.ini
index 780ebf85c20..99a50cec8d5 100644
--- a/rest-api/web/src/main/resources/shiro.ini
+++ b/rest-api/web/src/main/resources/shiro.ini
@@ -3,21 +3,15 @@
# =======================
[main]
-# Objects and their properties are defined here,
-# Such as the securityManager, Realms and anything
-# else needed to build the SecurityManager
-#authenticator
+# Authenticator
authenticator = org.eclipse.kapua.service.authentication.shiro.KapuaAuthenticator
securityManager.authenticator = $authenticator
-#
-# Auth filters
-kapuaAuthcAccessToken = org.eclipse.kapua.app.api.core.auth.KapuaTokenAuthenticationFilter
-
##########
# Realms #
##########
+
# Login
kapuaUserPassAuthenticatingRealm = org.eclipse.kapua.service.authentication.shiro.realm.UserPassAuthenticatingRealm
kapuaApiKeyAuthenticatingRealm = org.eclipse.kapua.service.authentication.shiro.realm.ApiKeyAuthenticatingRealm
@@ -35,22 +29,13 @@ securityManager.realms = $kapuaAuthorizingRealm, $kapuaAccessTokenAuthenticating
securityManager.rememberMeManager.cookie.name = kapua-rememberme
securityManager.rememberMeManager.cookie.maxAge = 0
-[users]
-# The 'users' section is for simple deployments
-# when you only need a small number of statically-defined
-# set of User accounts.
-
-[roles]
-# The 'roles' section is for simple deployments
-# when you only need a small number of statically-defined
-# roles.
+#
+# Auth filters
+kapuaAuthcAccessToken = org.eclipse.kapua.app.api.core.auth.KapuaTokenAuthenticationFilter
[urls]
-# The 'urls' section is used for url-based security
-# in web applications. We'll discuss this section in the
-# Web documentation
-# Authentication
+# Filter Mappings
/v1/authentication/info = kapuaAuthcAccessToken
/v1/authentication/logout = kapuaAuthcAccessToken
diff --git a/service/security/shiro/src/main/java/org/eclipse/kapua/service/authentication/shiro/KapuaAuthenticator.java b/service/security/shiro/src/main/java/org/eclipse/kapua/service/authentication/shiro/KapuaAuthenticator.java
index 89688325ba0..976e5df1fb7 100644
--- a/service/security/shiro/src/main/java/org/eclipse/kapua/service/authentication/shiro/KapuaAuthenticator.java
+++ b/service/security/shiro/src/main/java/org/eclipse/kapua/service/authentication/shiro/KapuaAuthenticator.java
@@ -12,10 +12,6 @@
*******************************************************************************/
package org.eclipse.kapua.service.authentication.shiro;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.List;
-
import org.apache.shiro.ShiroException;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
@@ -26,13 +22,18 @@
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+
/**
- * Kapua Shiro Authenticator.
+ * Kapua Shiro Authenticator.
+ *
* This authenticator provide more significantly exception message in a multi-realm configuration.
- * The code is derived from the original {@link ModularRealmAuthenticator} because the default Shiro implementation doesn't support detailed messages in a multirealm configuration.
- *
- * since 1.0
+ * The code is derived from the original {@link ModularRealmAuthenticator} because the
+ * default Shiro implementation doesn't support detailed messages in a multirealm configuration.
*
+ * @since 1.0.0
*/
public class KapuaAuthenticator extends ModularRealmAuthenticator {
@@ -45,6 +46,7 @@ protected AuthenticationInfo doMultiRealmAuthentication(Collection