code: private Credentials getCredentials(final Subject subject, SessionRequestInfo sri) throws ResourceException
     {
        CredentialsImpl credentials = null;
        if (subject != null)
        {
           credentials = SecurityHelper.doPrivilegedAction(new PrivilegedAction<CredentialsImpl>()
           {
              public CredentialsImpl run()
              {
                 Iterator<Object> i = subject.getPrivateCredentials().iterator();
                 while (i.hasNext())
                 {
                    Object o = i.next();
                    if (o instanceof PasswordCredential)
                    {
                       PasswordCredential cred = (PasswordCredential)o;
                       if (cred.getManagedConnectionFactory().equals(ManagedSessionFactory.this))
                       {
                          return new CredentialsImpl(cred.getUserName(), cred.getPassword());
                       }
                    }
                 }
                 return null;
              }
           });
        }
        if (credentials == null && sri.getUserName() != null)
        {
           credentials =
              new CredentialsImpl(sri.getUserName(), sri.getPassword() == null ? null : sri.getPassword()
                 .toCharArray());
        }
        if (LOG.isDebugEnabled())
        {
           LOG.debug("getCredentials: login = " + (credentials == null ? "undefined" : credentials.getUserID()));
        }
        return credentials;
     }
docs: Gets the credentials from the subject, if it cannot be found and the user name
  has been set in the {@link SessionRequestInfo}, we will use the credentials
  from the {@link SessionRequestInfo}, otherwise we will use the credentials
  defined in the configuration of the {@link ManagedSessionFactory}.