code: @SuppressWarnings({ "unchecked", "rawtypes" })
      private AuthenticationStatus handleFormLogin(String username, @Sensitive String password, HttpServletResponse rsp, Subject clientSubject,
                                                   HttpMessageContext httpMessageContext) throws AuthenticationException {
          AuthenticationStatus status = AuthenticationStatus.SEND_FAILURE;
          int rspStatus = HttpServletResponse.SC_UNAUTHORIZED;
          UsernamePasswordCredential credential = new UsernamePasswordCredential(username, password);
          status = utils.validateUserAndPassword(getCDI(), JavaEESecConstants.DEFAULT_REALM, clientSubject, credential, httpMessageContext);
          if (status == AuthenticationStatus.SUCCESS) {
              Map messageInfoMap = httpMessageContext.getMessageInfo().getMap();
              messageInfoMap.put("javax.servlet.http.authType", "FORM");
              messageInfoMap.put("javax.servlet.http.registerSession", Boolean.TRUE.toString());
              rspStatus = HttpServletResponse.SC_OK;
          } else if (status == AuthenticationStatus.NOT_DONE) {
              // set SC_OK, since if the target is not protected, it'll be processed.
              rspStatus = HttpServletResponse.SC_OK;
          } else {
              // TODO: Audit invalid user or password
          }
          rsp.setStatus(rspStatus);
          return status;
      }
docs: note that both username and password should not be null.