title: Shiro authentication with sessionId or username+password
body: <p>I do not have much experience in Java authentication frameworks and authentication workflow in general (only some theoretical knowledge), so for educational purposes I'm trying to create this type of authentication for my HTTP application:</p>
  
  <ol>
  <li>Client Posts login+password to <code>/login</code>. </li>
  <li>Shiro logs in the user by given credentials. Server returns client his <code>sessionId</code>.</li>
  <li>Client requests some kind of resource <code>/myresource?sessionId=1234567</code>.</li>
  <li>Shiro logs in the Subject by given <code>sessionId</code>. Then server does the regular workflow of getting the <code>/myresource</code> (with Shiro managing method-level access rights).</li>
  </ol>
  
  <p>Basically I have these questions:</p>
  
  <ol>
  <li>I guess I have no need for HTTP sessions nor Servlet sessions. Shiro has it's own session manager which is enough for my needs. Am I wrong?</li>
  <li>Is it good practice to give client the real sessionId or should I send some kind of sessionToken (which is resolved to sessionId on server side)?</li>
  <li>How do I login the Subject using sessionId (which the client should store locally)?</li>
  <li>Are there any other things I need to know before doing this kind of authentication?</li>
  </ol>
  
  <p>Thanks in advance.</p>