I have figured out a fairly simple workaround for this problem: 1. Remove the "authc = " line from the main section shiro.ini [main] authc = org.apache.shiro.web.filter.authc.PassThruAuthenticationFilter authc.loginUrl = /login shiro.unauthorizedUrl = /unauthorized ie. remove the line authc = org.apache.shiro.web.filter.authc.PassThruAuthenticationFilter
2. Manually create the PassThruAuthenticationFilter and put it into the objects map of the WebEnvironment before running init (which parses the INI file and creates objects) @Activate public void activate() { var environment = new IniWebEnvironment(); environment.getObjects().put("authc", new PassThruAuthenticationFilter()); environment.setIni(INI_FILE); environment.setServletContext(getServletContext()); environment.init(); It's early days so I can't tell for sure if this works everywhere. But the first app I tried it on came up like with shiro 1.13, so I have hope I can use the upcoming 2.0.1. (but best would be to be able to let the INI parser create objects under OSGi. Should I create a shiro issue for this?)