Matt Raible has posted a really nice blog article and video demonstrating a login use case with Apache Shiro. Check out the Java Web Application Security - Part III: Apache Shiro Login Demo blog post and the video: