have to be a static singleton, but there should only be a single instance used by the application, whether its a static singleton or not. standalone applications here is the simplest way to enable an application singleton securitymanager in spring applications: ... web applications shiro has first-rate...