anchor.diff:  ----
   
   
  -==== Tenant setup
  +==== Tenant Setup
   
   Since we did not give access for all the tenant management to our new `CS` account, let's have our superadmin create a first tenant:
   
  
positive.code: 
  You can use the property `org.killbill.security.shiroResourcePath` to specify the location of this file. When using Docker, you can bind mount the file, e.g. specify `-v /path/to/shiro.ini:/var/lib/killbill/shiro.ini -e KILLBILL_SECURITY_SHIRO_RESOURCE_PATH=file:/var/lib/killbill/shiro.ini`.
  
  ===== Role and user setup
  
  Let's create a new role `customer_support`:
  
  
negative.code: 
  == Overview
  
  **Terminology**: In this documentation, a user means a 'user or the api', which maps to the user credential passed through api. For example, when using the `-u admin:password` in most of our cURL examples, the user is `admin` and its password is `password`.
  
  **Assumptions**: We assume the reader went through the http://docs.killbill.io/latest/getting_started.html[Getting started] documentation and has a running system (both killbill and kaui) running on IP=`127.0.0.1`.
  
  === Shiro
  
  Each api request to Kill Bill requires authentication. The authentication phase verifies that the user exists in the system and that its credentials are correct. Once the credentials have been validated, the roles associated to the user are then extracted, and then the set of permissions associated to each role are also retrieved. The full list of available permissions can be found https://github.com/killbill/killbill-api/blob/master/src/main/java/org/killbill/billing/security/Permission.java[here].
  
  The credentials are passed in the request using http basic authentication mechanism and Kill Bill relies on http://shiro.apache.org/[shiro] for the backend implementation. Shiro supports multiple backend implementations, and we integrated a few of them including:
  
  * Simple configuration file (`shiro.ini` file)
  * Database configuration
  