code: protected void validateCredentials(final UsernamePasswordCredentials credentials,
                                         final OAuthRegisteredService registeredService,
                                         final WebContext context) {
          if (!OAuth20Utils.checkClientSecret(registeredService, credentials.getPassword())) {
              throw new CredentialsException("Bad secret for client identifier: " + credentials.getPassword());
          }
      }
docs: Validate credentials.
  
  @param credentials       the credentials
  @param registeredService the registered service
  @param context           the context