code: public void authenticate(DbSession session, UserDto user, @Nullable String password, Method method) {
      if (user.getHashMethod() == null) {
        throw AuthenticationException.newBuilder()
          .setSource(Source.local(method))
          .setLogin(user.getLogin())
          .setMessage("null hash method")
          .build();
      }
  
      HashMethod hashMethod;
      try {
        hashMethod = HashMethod.valueOf(user.getHashMethod());
      } catch (IllegalArgumentException ex) {
        throw AuthenticationException.newBuilder()
          .setSource(Source.local(method))
          .setLogin(user.getLogin())
          .setMessage(format("Unknown hash method [%s]", user.getHashMethod()))
          .build();
      }
  
      AuthenticationResult result = hashMethod.checkCredentials(user, password);
      if (!result.isSuccessful()) {
        throw AuthenticationException.newBuilder()
          .setSource(Source.local(method))
          .setLogin(user.getLogin())
          .setMessage(result.getFailureMessage())
          .build();
      }
  
      // Upgrade the password if it's an old hashMethod
      if (hashMethod != DEFAULT) {
        DEFAULT.storeHashPassword(user, password);
        dbClient.userDao().update(session, user);
      }
    }
docs: This method authenticate a user with his password against the value stored in user.
  If authentication failed an AuthenticationException will be thrown containing the failure message.
  If the password must be updated because an old algorithm is used, the UserDto is updated but the session
  is not committed