code: public Account authenticate(AuthenticationToken authenticationToken) {
  
          if (accountCache != null) {
              Account account = accountCache.getIfPresent(authenticationToken);
              if (account != null) {
                  return account;
              }
          }
  
          Account authenticatedAccount = null;
          for (Realm realm : allRealms) {
              if (realm.canAuthenticate(authenticationToken)) {
                  Account account = realm.authenticate(authenticationToken);
                  if (account != null && !account.isDisabled()) {
                      // create a sanitized copy of this account
                      authenticatedAccount = new Account(account.getName(), account.getCredentials().sanitize());
                      break;
                  }
              }
          }
  
          // no authentication
          if (authenticatedAccount == null) {
              return null;
          }
  
          // aggregate metadata, roles, & permissions
          final Account aggregateAccount = authenticatedAccount;
          allRealms.stream()
                  .filter(realm -> realm.hasAccount(aggregateAccount.getUsername()))
                  .map(realm -> realm.getAccount(aggregateAccount.getUsername()))
                  .filter(account -> account.isEnabled())
                  .forEach(account -> {
                      if (Strings.isNullOrEmpty(aggregateAccount.getName())) {
                          aggregateAccount.setName(account.getName());
                      }
                      aggregateAccount.addEmailAddresses(account.getEmailAddresses());
                      aggregateAccount.addTokens(account.getTokens());
                      aggregateAccount.getAuthorizations()
                              .addRoles(account.getAuthorizations().getRoles())
                              .addPermissions(account.getAuthorizations().getPermissions());
                  });
  
          if (accountCache != null) {
              // cache this assembled account
              accountCache.put(authenticationToken, aggregateAccount);
          }
  
          return aggregateAccount;
      }
docs: Tries to authenticate an AuthenticationToken.
  
  @param authenticationToken
  @return an Account instance if authentication is successful