Well, it would be like any other part of an MVC application.
The Model would store user details, including (hashed) passwords and access permissions; the View would display a login form. The Controller would pass whatever it's got from the form (maybe nothing) to the Model for it to decide if the login is legitimate. Depending on its response, the next page will be the login form again (on failure) or the first login-protected page (on success).
Presumably you have somewhere to persist application state from page to page; store the user's login details there and every request for a login-protected page would have to pass through a check to see if those details are there. How exactly that works depends on your design.