code: @PostMapping(value = "/login", produces = APPLICATION_JSON_VALUE)
    @ResponseBody
    public LoginResponse login(@Valid @RequestBody LoginRequest login, HttpServletRequest request) {
      if (login == null) {
        throw new HttpMessageNotReadableException("Missing login");
      }
      if (isUser2fa()) {
        throw new BadCredentialsException(
            "Login using /api/v1/login is disabled, two factor authentication is enabled");
      }
  
      return runAsSystem(
          () -> {
            UsernamePasswordAuthenticationToken authToken =
                new UsernamePasswordAuthenticationToken(login.getUsername(), login.getPassword());
  
            authToken.setDetails(new WebAuthenticationDetails(request));
  
            // Authenticate the login
            Authentication authentication = authenticationManager.authenticate(authToken);
            if (!authentication.isAuthenticated()) {
              throw new BadCredentialsException("Unknown username or password");
            }
  
            User user =
                dataService.findOne(
                    USER,
                    new QueryImpl<User>().eq(UserMetadata.USERNAME, authentication.getName()),
                    User.class);
  
            if (user.isChangePassword()) {
              throw new BadCredentialsException(
                  "Unable to log in because a password reset is required. Sign in to the website to reset your password.");
            }
  
            // User authenticated, log the user in
            SecurityContextHolder.getContext().setAuthentication(authentication);
  
            // Generate a new token for the user
            String token =
                tokenService.generateAndStoreToken(authentication.getName(), "REST API login");
            return new LoginResponse(
                token, user.getUsername(), user.getFirstName(), user.getLastName());
          });
    }
docs: Login to the api.
  
  <p>Returns a json object with a token on correct login else throws an AuthenticationException.
  Clients can use this token when calling the api.
  
  <p>Example:
  
  <p>Request: {username:admin,password:xxx}
  
  <p>Response: {token: b4fd94dc-eae6-4d9a-a1b7-dd4525f2f75d}