这是我解决这个问题的方法。
首先我将我的shiro.ini 设置如下（相关部分）：
[main]
authc.failureKeyAttribute = shiroLoginFailure
authc.loginUrl = /login.jsp
authc.successUrl = /LogIn
logout.redirectUrl = /login.jsp
captcha = path.to.my.class.VerifyUserFilter
...
[urls]
/login.jsp = captcha,authc
/* = authc
然后我通过扩展FormAuthenticationFilter 类并覆盖读取参数的doFilterInternal 方法创建了我的VerifyUserFilter 类，调用Google API 以验证响应，然后根据结果重定向如果验证失败或移动到过滤器链中的下一项 - 在这种情况下为authc，则转到登录页面。
这是我的VerifyUserFilter 类的完整实现：
import org.apache.shiro.web.util.WebUtils;
public class VerifyUserFilter extends org.apache.shiro.web.filter.authc.FormAuthenticationFilter {
@Override
public void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain)
throws ServletException, IOException {
org.apache.log4j.Logger log = org.apache.log4j.Logger.getLogger(VerifyUserFilter.class);
if (isLoginSubmission(request, response)){
String user = WebUtils.getCleanParam(request, "username");
String verifId = WebUtils.getCleanParam(request, "g-recaptcha-response");
log.debug("Verif ID: " + verifId);
if (verifId == null || "".equals(verifId)) {
log.warn("User " + user + " missed the captcha challenge and is returned to login page.");
saveRequestAndRedirectToLogin(request, response);
} else {
// Now do the verification of the captcha
final String url = "https://www.google.com/recaptcha/api/siteverify";
final String secret = "6Lxxxxxxxxxxxxxx";
// Send the POST request to the Google API
URL obj = new URL(url);
HttpsURLConnection con = (HttpsURLConnection)obj.openConnection();
con.setRequestMethod("POST");
String params = "secret=" + secret + "&response=" + verifId;
con.setDoOutput(true);
DataOutputStream wr = new DataOutputStream(con.getOutputStream());
log.debug("Sending POST to " + url);
wr.writeBytes(params);
wr.flush();
wr.close();
// Get the response code
int respCode = con.getResponseCode();
log.debug("Response code: " + respCode);
// Read in the response data
BufferedReader in = new BufferedReader(new InputStreamReader(con.getInputStream()));
String line;
StringBuilder input = new StringBuilder();
log.debug("Reading response data...");
while ((line = in.readLine()) != null){
input.append(line);
}
in.close();
log.debug("Reponse data: " + input);
// Parse the json received to determine if the verif was successful
JsonReader jr = Json.createReader(new StringReader(input.toString()));
JsonObject jo = jr.readObject();
jr.close();
if (jo.getBoolean("success")){
log.debug("User " + user + " is good to go, not a robot!");
// Move on to the next filter
chain.doFilter(request, response);
} else {
// User did not solve the captcha, return to login page
log.warn("User " + user + " failed the captcha challenge and is returned to login page.");
saveRequestAndRedirectToLogin(request, response);
}
}
} else {
log.debug("Not a login attempt, carry on.");
chain.doFilter(request, response);
}
}
}