docs: public void login(HttpServletRequest req, HttpServletResponse resp, String username, @Sensitive String password, WebAppSecurityConfig config,
                        BasicAuthAuthenticator basicAuthAuthenticator) throws ServletException {
          // Per JASPI spec no login method allowed with JASPIC
          String isJaspiAuthenticated = (String) req.getServletContext().getAttribute("com.ibm.ws.security.jaspi.authenticated");
          if (isJaspiAuthenticated != null && isJaspiAuthenticated.equals(Boolean.toString(Boolean.TRUE))) {
              throw new ServletException("The login method may not be invoked while JASPI authentication is active.");
          }
          boolean logoutOnHttpSessionExp = config.getLogoutOnHttpSessionExpire();
          if (req.getRequestedSessionId() != null && (req.isRequestedSessionIdValid() == false) && logoutOnHttpSessionExp)
              req.getSession(true);
  
          throwExceptionIfAlreadyAuthenticate(req, resp, config, username);
  
          AuthenticationResult authResult = basicAuthAuthenticator.basicAuthenticate(null, username, password, req, resp);
          if (authResult == null || authResult.getStatus() != AuthResult.SUCCESS) {
              String realm = authResult.realm;
              if (realm == null) {
                  realm = collabUtils.getUserRegistryRealm(securityServiceRef);
              }
              WebReply reply = null;
              reply = createReplyForAuthnFailure(authResult, realm);
  
              Audit.audit(Audit.EventID.SECURITY_API_AUTHN_01, req, authResult, Integer.valueOf(reply.getStatusCode()));
  
              if (authResult.passwordExpired == true) {
                  throw new PasswordExpiredException(authResult.getReason());
              } else if (authResult.userRevoked == true) {
                  throw new UserRevokedException(authResult.getReason());
              } else {
                  throw new ServletException(authResult.getReason());
              }
  
          } else {
  
              Audit.audit(Audit.EventID.SECURITY_API_AUTHN_01, req, authResult, Integer.valueOf(HttpServletResponse.SC_OK));
  
          }
          postProgrammaticAuthenticate(req, resp, authResult);
      }