code: public final ConversationState authenticate(Credentials credentials) throws LoginException
     {
  
        CredentialsImpl thisCredentials;
        if (credentials instanceof CredentialsImpl)
        {
           thisCredentials = (CredentialsImpl)credentials;
        }
        else if (credentials instanceof SimpleCredentials)
        {
           String name = ((SimpleCredentials)credentials).getUserID();
           char[] pswd = ((SimpleCredentials)credentials).getPassword();
           thisCredentials = new CredentialsImpl(name, pswd);
        }
        else
           throw new LoginException(
              "Credentials for the authentication should be CredentialsImpl or SimpleCredentials type");
  
        // SYSTEM
        if (thisCredentials.getUserID().equals(IdentityConstants.SYSTEM))
        {
           Identity sid = new Identity(IdentityConstants.SYSTEM, new HashSet<MembershipEntry>());
           return new ConversationState(sid);
        }
  
        // prepare to new login
        // uses BasicCallbackHandler
        CallbackHandler handler = new BasicCallbackHandler(thisCredentials.getUserID(), thisCredentials.getPassword());
  
        // and try to login
        try
        {
  
           LoginContext loginContext = new LoginContext(config.getSecurityDomain(), handler);
           loginContext.login();
  
        }
        catch (javax.security.auth.login.LoginException e)
        {
           throw new LoginException("Login failed for " + thisCredentials.getUserID() + " " + e);
        }
  
        if (log.isDebugEnabled())
           log.debug("Logged " + thisCredentials.getUserID());
  
        // supposed to be set
        Identity identity = identityRegistry.getIdentity(thisCredentials.getUserID());
        if (identity == null)
        {
           throw new LoginException("Identity not found, check Loginmodule, userId " + thisCredentials.getUserID());
        }
        ConversationState state = new ConversationState(identity);
        String[] aNames = thisCredentials.getAttributeNames();
        for (String name : aNames)
        {
           state.setAttribute(name, thisCredentials.getAttribute(name));
        }
  
        ConversationState.setCurrent(state);
        return state;
  
     }
docs: /*
  (non-Javadoc)
  @see
  org.exoplatform.services.jcr.access.AuthenticationPolicy#authenticate(javax.jcr.Credentials)