code: public function authenticate($user, $request, $response)
      {
          list($username, $password) = $request->getAuthCredentials();
  
          if ($this->auth) {
              if ($username !== null || $password !== null) {
                  $identity = $user->getIdentity() ?: call_user_func($this->auth, $username, $password);
  
                  if ($identity === null) {
                      $this->handleFailure($response);
                  } elseif ($user->getIdentity(false) !== $identity) {
                      $user->switchIdentity($identity);
                  }
  
                  return $identity;
              }
          } elseif ($username !== null) {
              $identity = $user->loginByAccessToken($username, get_class($this));
              if ($identity === null) {
                  $this->handleFailure($response);
              }
  
              return $identity;
          }
  
          return null;
      }
docs: {@inheritdoc}