anchor.diff:  
   Check for later releases by searching [Maven Central Repo](http://search.maven.org/#search|ga|1|isis-module-security-dom).
   
  +[[shiro-configuration]]
   ==== Shiro configuration (shiro.ini)
   
   The module includes `org.isisaddons.module.security.shiro.IsisModuleSecurityRealm`, an implementation of Apache Shiro's `org.apache.shiro.realm.AuthorizingRealm` class.
  
positive.code: The users are created explicitly by the administrator.
  
  * Optionally a delegate authentication realm can be configured; if so then delegated users can be created and their credentials will be authenticated by the delegate authentication realm.
  Users are created _automatically_ when that user attempts to log in.
  However, for safety their `ApplicationUser` accounts are created in a disabled state and with no roles, so the administrator is still required to update them.
  
  Once the user is created, then additional information about that user can be captured, including their name and contact details.
  
negative.code: isisModuleSecurityRealm.delegateAuthenticationRealm=$someOtherRealm
  ----
  <1> the `someOtherRealm` variable defines some other realm to perform authentication.
  
  To disable the automatic creation of delegate users, use:
  
  [source,ini]
  ----
  isisModuleSecurityRealm.autoCreateUser=false
  ----
  
  
  
  ==== Isis domain services
  