protected WebSecurityManager createWebSecurityManager() {

        Ini ini = getIni();
        if (!CollectionUtils.isEmpty(ini)) {
            factory.setIni(ini);
        }

        Map<String, Object> defaults = getDefaults();
        if (!CollectionUtils.isEmpty(defaults)) {
            factory.setDefaults(defaults);
        }

        WebSecurityManager wsm = (WebSecurityManager) factory.getInstance();

        //SHIRO-306 - get beans after they've been created (the call was before the factory.getInstance() call,
        //which always returned null.
        Map<String, ?> beans = factory.getBeans();
        if (!CollectionUtils.isEmpty(beans)) {
            this.objects.putAll(beans);
        }

        return wsm;
    }
Creates an {@link Ini} instance reflecting the specified path, or {@code null} if the path does not exist and
is not required.
<p/>
If the path is required and does not exist or is empty, a {@link ConfigurationException} will be thrown.

@param configLocation the resource path to load into an {@code Ini} instance.
@param required       if the path must exist and be converted to a non-empty {@link Ini} instance.
@return an {@link Ini} instance reflecting the specified path, or {@code null} if the path does not exist and
is not required.
@throws ConfigurationException if the path is required but results in a null or empty Ini instance.
web/src/main/java/org/apache/shiro/web/env/IniWebEnvironment.java