code: @Override
      public Principal authenticate(String username, String credentials) {
          GenericPrincipal principal = (GenericPrincipal) getPrincipal(username);
          if (null != principal) {
              try {
                  if (!PasswordStorage.verifyPassword(credentials, principal.getPassword())) {
                      principal = null;
                  }
              } catch (CannotPerformOperationException | InvalidHashException e) {
                  LOGR.log(Level.WARNING, e.getMessage());
                  principal = null;
              }
          }
          return principal;
      }
docs: Return the Principal associated with the specified username and
  credentials, if one exists in the user data store; otherwise return null.