code: protected Filter createFilter(final T configuration) {
          ShiroConfiguration shiroConfig = narrow(configuration);
          final IniWebEnvironment shiroEnv = new IniWebEnvironment();
          shiroEnv.setConfigLocations(shiroConfig.iniConfigs());
          shiroEnv.init();
  
          AbstractShiroFilter shiroFilter = new AbstractShiroFilter() {
              @Override
              public void init() throws Exception {
                  Collection<Realm> realms = createRealms(configuration);
                  WebSecurityManager securityManager = realms.isEmpty()
                          ? shiroEnv.getWebSecurityManager()
                          : new DefaultWebSecurityManager(realms);
                  setSecurityManager(securityManager);
                  setFilterChainResolver(shiroEnv.getFilterChainResolver());
              }
          };
          return shiroFilter;
      }
docs: Create the Shiro filter. Overriding this method allows for complete customization of how Shiro is initialized.