code: protected UserDetails authenticateUser(String username, String password, HttpRequest authRequest) throws AuthenticationException {
          UserDetails userDetails;
          IUserAuthentication ua;
          if (OAuthConfig.getUserAuthenticationClass() != null) {
              try {
                  ua = OAuthConfig.getUserAuthenticationClass().newInstance();
                  userDetails = ua.authenticate(username, password, authRequest);
              } catch (InstantiationException | IllegalAccessException e) {
                  LOG.error("cannot instantiate user authentication class", e);
                  throw new AuthenticationException(e.getMessage());
              }
          } else {
              // if no specific UserAuthentication used, always returns customerId - 12345
              userDetails = new UserDetails("12345", null);
          }
          return userDetails;
      }
docs: todo not tested
  
  @param username    user name
  @param password    password
  @param authRequest auth http request
  @return user details
  @throws AuthenticationException authentication exception