谢邀, 你只需要实现自己的Realm就行, 比如:

public class MyRealm extends AuthorizingRealm {

  // 认证
  @Override
  protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

    // TODO 从数据库中获取用户信息, 从Mongo中查出来的
    return null;
  }

  // 授权
  @Override
  protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

    // TODO 从数据库中获取授权信息, 从Mongo中查出来的
    return null;
  }
}

然后把你自己的Realm设置到RealmSecurityManager中, 比如:

DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
securityManager.setRealm(new MyRealm());

然后把这个SecurityManager设置到ShiroFilter中就行, 比如:

ShiroFilterFactoryBean shiroFilterFactory = new ShiroFilterFactoryBean();
shiroFilterFactory.setSecurityManager(securityManager);