@RequestMapping(value = "/login", method = RequestMethod.POST)
    public String login(Model model, @ModelAttribute LoginCommand command, BindingResult errors) {
        loginValidator.validate(command, errors);

        if (errors.hasErrors()) {
            return showLoginForm(model, command);
        }

        UsernamePasswordToken token = new UsernamePasswordToken(command.getUsername(),
                        command.getPassword(), command.isRememberMe());
        try {
            SecurityUtils.getSubject().login(token);
        } catch (AuthenticationException e) {
            errors.reject("error.login.generic", "Invalid username or password.  Please try again.");
        }

        if (errors.hasErrors()) {
            return showLoginForm(model, command);
        } else {
            return "redirect:/s/home";
        }
    }
Web MVC controller that handles security-related web requests, such as login and logout.
samples/spring-hibernate/src/main/java/org/apache/shiro/samples/sprhib/web/SecurityController.java