code: @Override
      protected boolean validatePassword(StandardCredentials requestCredentials, StandardCredentials storedCredentials) {
          final String storedPassword = storedCredentials.getPassword();
          final String username = requestCredentials.getUsername();
          final String password = requestCredentials.getPassword();
          boolean authenticated = false;
  
          // test Apache MD5 variant encrypted password
          if (storedPassword.startsWith("$apr1$")) {
              if (storedPassword.equals(Md5Crypt.apr1Crypt(password, storedPassword))) {
                  log.trace("Apache MD5 encoded password matched for user '{}'", username);
                  authenticated = true;
              }
          }
          // test Unsalted SHA password
          else if (storedPassword.startsWith("{SHA}")) {
              String password64 = Base64.encodeBase64String(DigestUtils.sha1(password));
              if (storedPassword.substring("{SHA}".length()).equals(password64)) {
                  log.trace("Unsalted SHA-1 encoded password matched for user '{}'", username);
                  authenticated = true;
              }
          }
          // test Libc Crypt password
          else if (!isAllowClearTextPasswords() && storedPassword.equals(Crypt.crypt(password, storedPassword))) {
              log.trace("Libc crypt encoded password matched for user '{}'", username);
              authenticated = true;
          }
          // test Clear Text password
          else if (isAllowClearTextPasswords() && storedPassword.equals(password)) {
              log.trace("Clear text password matched for user '{}'", username);
              authenticated = true;
          }
  
          return authenticated;
      }
docs: htpasswd supports a few other password encryption schemes than the StandardCredentialsRealm.
  
  @param requestCredentials
  @param storedCredentials
  @return true if the request password validates against the stored password