code: def authenticate(self, request):
          
          access_token = self.get_access_token(request)
  
          if not access_token:
              return None
  
          try:
              user = self.backend.get_or_create_user(access_token, None, None)
          except HTTPError as exc:
              resp = exc.response
  
              # if the oidc provider returns 401, it means the token is invalid.
              # in that case, we want to return the upstream error message (which
              # we can get from the www-authentication header) in the response.
              if resp.status_code == 401 and 'www-authenticate' in resp.headers:
                  data = parse_www_authenticate_header(resp.headers['www-authenticate'])
                  raise exceptions.AuthenticationFailed(data['error_description'])
  
              # for all other http errors, just re-raise the exception.
              raise
          except SuspiciousOperation as exc:
              LOGGER.info('Login failed: %s', exc)
              raise exceptions.AuthenticationFailed('Login failed')
  
          if not user:
              msg = 'Login failed: No user found for the given access token.'
              raise exceptions.AuthenticationFailed(msg)
  
          return user, access_token
docs: Authenticate the request and return a tuple of (user, token) or None
          if there was no authentication attempt.