diff --git a/scm-webapp/src/main/java/sonia/scm/ScmContextListener.java b/scm-webapp/src/main/java/sonia/scm/ScmContextListener.java
index 54b146a4d8..59145a40f8 100644
--- a/scm-webapp/src/main/java/sonia/scm/ScmContextListener.java
+++ b/scm-webapp/src/main/java/sonia/scm/ScmContextListener.java
@@ -35,6 +35,7 @@ package sonia.scm;
 
 //~--- non-JDK imports --------------------------------------------------------
 
+import com.google.common.collect.Lists;
 import com.google.inject.Guice;
 import com.google.inject.Injector;
 import com.google.inject.Module;
@@ -53,10 +54,11 @@ import sonia.scm.web.security.LocalSecurityContextHolder;
 
 //~--- JDK imports ------------------------------------------------------------
 
-import java.util.ArrayList;
 import java.util.List;
 
+import javax.servlet.ServletContext;
 import javax.servlet.ServletContextEvent;
+import org.apache.shiro.guice.web.ShiroWebModule;
 
 /**
  *
@@ -100,8 +102,8 @@ public class ScmContextListener extends GuiceServletContextListener
 
       // call destroy event
       globalInjector.getInstance(
-          ServletContextListenerHolder.class).contextDestroyed(
-          servletContextEvent);
+        ServletContextListenerHolder.class).contextDestroyed(
+        servletContextEvent);
     }
 
     super.contextDestroyed(servletContextEvent);
@@ -116,6 +118,8 @@ public class ScmContextListener extends GuiceServletContextListener
   @Override
   public void contextInitialized(ServletContextEvent servletContextEvent)
   {
+    this.servletContext = servletContextEvent.getServletContext();
+
     if (SCMContext.getContext().getStartupError() == null)
     {
       ScmUpgradeHandler upgradeHandler = new ScmUpgradeHandler();
@@ -133,8 +137,8 @@ public class ScmContextListener extends GuiceServletContextListener
     if ((globalInjector != null) &&!startupError)
     {
       globalInjector.getInstance(
-          ServletContextListenerHolder.class).contextInitialized(
-          servletContextEvent);
+        ServletContextListenerHolder.class).contextInitialized(
+        servletContextEvent);
     }
   }
 
@@ -155,7 +159,7 @@ public class ScmContextListener extends GuiceServletContextListener
     }
     else
     {
-      globalInjector = getDefaultInjector();
+      globalInjector = getDefaultInjector(servletContext);
     }
 
     return globalInjector;
@@ -165,9 +169,11 @@ public class ScmContextListener extends GuiceServletContextListener
    * Method description
    *
    *
+   *
+   * @param servletContext
    * @return
    */
-  private Injector getDefaultInjector()
+  private Injector getDefaultInjector(ServletContext servletContext)
   {
     PluginLoader pluginLoader = new DefaultPluginLoader();
     BindingExtensionProcessor bindExtProcessor =
@@ -178,11 +184,14 @@ public class ScmContextListener extends GuiceServletContextListener
     ClassOverrides overrides = ClassOverrides.findOverrides();
     ScmServletModule main = new ScmServletModule(pluginLoader,
                               bindExtProcessor, overrides);
-    List<Module> moduleList = new ArrayList<Module>();
+    List<Module> moduleList = Lists.newArrayList();
 
+    moduleList.add(ShiroWebModule.guiceFilterModule());
+    moduleList.add(main);
+    moduleList.add(new ScmSecurityModule(servletContext));
     moduleList.addAll(bindExtProcessor.getModuleSet());
     moduleList.addAll(overrides.getModules());
-    moduleList.add(0, main);
+    
 
     Injector injector = Guice.createInjector(moduleList);
     SCMContextProvider context = SCMContext.getContext();
@@ -232,6 +241,9 @@ public class ScmContextListener extends GuiceServletContextListener
   /** Field description */
   private Injector globalInjector;
 
+  /** Field description */
+  private ServletContext servletContext;
+
   /** Field description */
   private boolean startupError = false;
 }
diff --git a/scm-webapp/src/main/java/sonia/scm/ScmSecurityModule.java b/scm-webapp/src/main/java/sonia/scm/ScmSecurityModule.java
new file mode 100644
index 0000000000..688c655ab0
--- /dev/null
+++ b/scm-webapp/src/main/java/sonia/scm/ScmSecurityModule.java
@@ -0,0 +1,73 @@
+/**
+ * Copyright (c) 2010, Sebastian Sdorra All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer. 2. Redistributions in
+ * binary form must reproduce the above copyright notice, this list of
+ * conditions and the following disclaimer in the documentation and/or other
+ * materials provided with the distribution. 3. Neither the name of SCM-Manager;
+ * nor the names of its contributors may be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * http://bitbucket.org/sdorra/scm-manager
+ *
+ */
+
+
+
+package sonia.scm;
+
+//~--- non-JDK imports --------------------------------------------------------
+
+import org.apache.shiro.guice.web.ShiroWebModule;
+
+import sonia.scm.security.ScmRealm;
+
+//~--- JDK imports ------------------------------------------------------------
+
+import javax.servlet.ServletContext;
+
+/**
+ *
+ * @author Sebastian Sdorra
+ */
+public class ScmSecurityModule extends ShiroWebModule
+{
+
+  /**
+   * Constructs ...
+   *
+   *
+   * @param servletContext
+   */
+  ScmSecurityModule(ServletContext servletContext)
+  {
+    super(servletContext);
+  }
+
+  //~--- methods --------------------------------------------------------------
+
+  /**
+   * Method description
+   *
+   */
+  @Override
+  protected void configureShiroWeb()
+  {
+    bindRealm().to(ScmRealm.class);
+  }
+}