That was it. So the problem was: I had another Filter which was executing after my Shiro security filter, which also inherited from AbstractShiroFilter. The second filter seemed to overwrite anything the first filter did in terms of SecurityManagers.
Moral of the story: Only have one AbstractShiroFilter implementation. I don't believe this was deliberate, probably just a copy & paste error. -- View this message in context: http://shiro-user.582556.n2.nabble.com/Custom-WebSecurityManager-not-being-used-by-SecurityUtils-tp6581200p6584876.html Sent from the Shiro User mailing list archive at Nabble.com.
