code: private boolean isValidTenantUserAccess(Tenant tenant, String userid, String password, Permission permNeeded) {
          TenantDefinition tenantDef = tenant.getDefinition();
          assert tenantDef != null;
          if (tenantDef.getUsers().size() == 0) {
              // We allow access to the default tenant when it has no users defined.
              return tenant.getName().equals(m_defaultTenantName);
          }
          UserDefinition userDef = tenantDef.getUser(userid);
          if (userDef == null || Utils.isEmpty(password)) {
              return false;   // no such user or no password given
          }
          if (userDef.getHash() != null) {
              if (!PasswordManager.checkPassword(password, userDef.getHash())) {
                  return false;   // password is hashed but didn't match
              }
          } else {
              if (!password.equals(userDef.getPassword())) {
                  return false;   // password is plaintext but didn't match
              }
          }
          return isValidUserAccess(userDef, permNeeded);
      }
docs: Validate the given user ID and password.