code: @Override
  	public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
  			throws IOException {
  		final String requestURI = request.getRequestURI();
  		UserAuthentication userAuth = null;
  		String username = request.getParameter(USERNAME);
  		String password = request.getParameter(PASSWORD);
  		String appid = SecurityUtils.getAppidFromAuthRequest(request);
  
  		if (requestURI.endsWith(LDAP_ACTION) && !StringUtils.isBlank(username) && !StringUtils.isBlank(password)) {
  			try	{
  				App app = Para.getDAO().read(App.id(appid == null ? Config.getRootAppIdentifier() : appid));
  				Authentication auth = new LDAPAuthentication(username, password).withApp(app);
  				// set authentication in context to avoid warning message from SpringSecurityAuthenticationSource
  				SecurityContextHolder.getContext().setAuthentication(new AnonymousAuthenticationToken("key",
  						"anonymous", AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS")));
  				Authentication ldapAuth = getAuthenticationManager().authenticate(auth);
  				if (ldapAuth != null) {
  					//success!
  					userAuth = getOrCreateUser(app, ldapAuth);
  				}
  			} catch (Exception ex) {
  				LOG.info("Failed to authenticate '{}' with LDAP server: {}", username, ex.getMessage());
  				throw new AuthenticationServiceException(ex.getMessage(), ex.getCause());
  			}
  		}
  
  		return SecurityUtils.checkIfActive(userAuth, SecurityUtils.getAuthenticatedUser(userAuth), true);
  	}
docs: Handles an authentication request.
  @param request HTTP request
  @param response HTTP response
  @return an authentication object that contains the principal object if successful.
  @throws IOException ex