code: private boolean authenticate(Session session, String userName, String password, PasswordEncrypter pe)
        throws Exception
     {
        boolean authenticated;
  
        Node userNode;
        try
        {
           userNode = utils.getUserNode(session, userName);
        }
        catch (PathNotFoundException e)
        {
           return false;
        }
        boolean enabled = userNode.canAddMixin(JCROrganizationServiceImpl.JOS_DISABLED);
        if (!enabled)
        {
           throw new DisabledUserException(userName);
        }
  
        if (pe == null)
        {
           authenticated = utils.readString(userNode, UserProperties.JOS_PASSWORD).equals(password);
        }
        else
        {
           String encryptedPassword =
              new String(pe.encrypt(utils.readString(userNode, UserProperties.JOS_PASSWORD).getBytes()));
           authenticated = encryptedPassword.equals(password);
        }
        if (authenticated)
        {
           Calendar lastLoginTime = Calendar.getInstance();
           userNode.setProperty(UserProperties.JOS_LAST_LOGIN_TIME, lastLoginTime);
           session.save();
        }
        return authenticated;
     }
docs: Checks if credentials matches.