@RequestMapping(method = RequestMethod.POST)
    protected String onSubmit(@RequestParam("username") String username,
                              @RequestParam("password") String password,
                              Model model) throws Exception {

        UsernamePasswordToken token = new UsernamePasswordToken(username, password);

        try {
            SecurityUtils.getSubject().login(token);
        } catch (AuthenticationException e) {
            LOGGER.debug("Error authenticating.", e);
            model.addAttribute("errorInvalidLogin", "The username or password was not correct.");

            return loginview;
        }

        return "redirect:/s/index";
    }
Spring MVC controller responsible for authenticating the user.

@since 0.1
samples/spring-mvc/src/main/java/org/apache/shiro/samples/spring/web/LoginController.java