If Shiro is configured for both {@link AuthenticationManagerInstaller authentication} and{@link AuthorizationManagerInstaller authorization} (as recommended), then this class isinstantiated twice, once in the role of {@link Authenticator} and once in the role of the {@link Authorizor}.
However, although there are two objects, they are set up to share the same {@link SecurityManager Shiro SecurityManager}(bound to a thread-local).