code: private Response handlePassword(TokenResponse response)
      {
          // The credentials of the resource owner.
          String username = response.getUsername();
          String password = response.getPassword();
  
          // Validate the credentials.
          String subject = mSpi.authenticateUser(username, password);
  
          // Extra properties to associate with an access token.
          Property[] properties = mSpi.getProperties();
  
          // The ticket for Authlete's /api/auth/token/* API.
          String ticket = response.getTicket();
  
          if (subject != null)
          {
              // Issue an access token and optionally an ID token.
              return getApiCaller().tokenIssue(ticket, subject, properties);
          }
          else
          {
              // The credentials are invalid. An access token is not issued.
              throw getApiCaller().tokenFail(ticket, Reason.INVALID_RESOURCE_OWNER_CREDENTIALS);
          }
      }
docs: Process the token request whose flow is "Resource Owner Password Credentials".