<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>1.2.4</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-web</artifactId>
    <version>1.2.4</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-ehcache</artifactId>
    <version>1.2.4</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.2.4</version>
</dependency>

<!-- 配置shiro的核心拦截器 -->
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context"
    xmlns:mvc="http://www.springframework.org/schema/mvc"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.1.xsd
        http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.1.xsd">

    <!-- Shiro Filter -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager" />
        <property name="loginUrl" value="/login" />
        <property name="successUrl" value="/main" />
        <property name="unauthorizedUrl" value="/login" />
        <property name="filterChainDefinitions">
            <value>
                /login = anon
                /query = authc
                /user/** = authc
                /** = authc
            </value>
        </property>
    </bean>

    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="myRealm" />
    </bean>

    <bean id="myRealm" class="com.why.service.UserRealm"/>

    <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager" />

    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

</beans>

package com.why.service;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

public class UserRealm extends AuthorizingRealm {

    /**
     * 授权，权限.
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection p) {
        String username = (String) p.getPrimaryPrincipal();
        System.out.println(username);

        //自己根据需要改改，添加角色，权限啥的
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        info.addRole("admin");
        info.addStringPermission("all");
        return info;
    }

    /**
     * 认证，是否可以登录.
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(
            AuthenticationToken token) throws AuthenticationException {

        UsernamePasswordToken myToken = (UsernamePasswordToken)token;
        
        // 用户名、密码
        String username = myToken.getUsername();
        Object password = myToken.getPassword().toString();

        // 简单判断一下
        if (username.equals("abc") && password.equals("123")) {
            SimpleAuthenticationInfo info = new SimpleAuthenticationInfo("哈哈",
                    "嘎嘎", getName());
            return info;

        }

        // 返回null，就是失败.
        return null;
    }

}

package com.why.controller;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;

@Controller
public class ShiroController {

    /**
     * 登录页面.
     * 
     * @param request
     * @return
     */
    @RequestMapping(value = "/login", method = RequestMethod.GET)
    public String login(HttpServletRequest request) {
        return "shiro/login";
    }

    /**
     * 表单登录.
     * 
     * @param username
     * @param password
     * @param session
     * @param request
     * @return
     */
    @RequestMapping(value = "/login", method = RequestMethod.POST)
    public String doLogin(String username, String password,
            HttpSession session, HttpServletRequest request) {

        // 令牌，估计还有别的类型的令牌
        UsernamePasswordToken token = new UsernamePasswordToken(username,
                password);

        
        try {
            // 里面会调用Realm里的doGetAuthenticationInfo方法进行用户认证
            SecurityUtils.getSubject().login(token);
            
            SecurityUtils.getSubject().isAuthenticated();
            
            
            session.setAttribute("username", username); // 写session什么的
            return "main";
        } catch (AuthenticationException e) {

            // login方法抛异常，表示认证失败
            request.setAttribute("message", "login fail.");
            return "shiro/login";
        }

    }

    /**
     * 退出登录.
     * 
     * @param req
     * @return
     */
    @RequestMapping(value = "logout")
    public String logout(HttpServletRequest req) {
        SecurityUtils.getSubject().logout();
        return "redirect:/login";
    }

}

<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
<%@page import="java.util.*"%>
<%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<%@taglib prefix="fmt" uri="http://java.sun.com/jsp/jstl/fmt"%>
<%@taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions"%>

<c:set var="ctx" value="${pageContext.request.contextPath}" />
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="x-ua-compatible" content="IE=9">
<meta name="renderer" content="webkit">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">

<title>Login</title>

</head>
<body>
    <form action="${ctx}/login" method="post">
        用户名：<input type="text" size="16" name="username" /><br /> 密码：<input type="text" size="16" name="password" /><br /> <input
            type="submit" value="登录" />
    </form>
</body>
</html>