Source:
<code>public SecurityIdentity authenticate(Principal principal, Evidence evidence) throws RealmUnavailableException, SecurityException { final SecurityManager securityManager = System.getSecurityManager(); if (securityManager != null) { securityManager.checkPermission(AUTHENTICATE); } ServerAuthenticationContext serverAuthenticationContext = new ServerAuthenticationContext(this, MechanismConfigurationSelector.constantSelector(MechanismConfiguration.EMPTY)); if (principal != null) serverAuthenticationContext.setAuthenticationPrincipal(principal); if (serverAuthenticationContext.verifyEvidence(evidence)) { if (serverAuthenticationContext.authorize()) { <START> Credential credential = evidence.asCredential(); <END> if (credential != null) { serverAuthenticationContext.addPrivateCredential(credential); } else { log.tracef("Evidence [%s] does not map to any credential type. Credentials are not available from authorized identity and identity propagation may not work", evidence.getClass().getName()); } serverAuthenticationContext.succeed(); return serverAuthenticationContext.getAuthorizedIdentity(); } else { serverAuthenticationContext.fail(); throw log.authenticationFailedAuthorization(); } } else { serverAuthenticationContext.fail(); throw log.authenticationFailedEvidenceVerification(); } }</code><technical_language>I making this generic clear passwords case align. This is more a mechanism (like PLAIN) credential is acquired, if clear, forwarded. a special check if evidence is a org.wildfly.security.evidence.PasswordGuessEvidence, if so, a PasswordCredential is explicitly created. If a generic asCredential() method, I worry end parallel class hierarchies types in them</technical_language>

Target:
public SecurityIdentity authenticate(Principal principal, Evidence evidence) throws RealmUnavailableException, SecurityException { final SecurityManager securityManager = System.getSecurityManager(); if (securityManager != null) { securityManager.checkPermission(AUTHENTICATE); } ServerAuthenticationContext serverAuthenticationContext = new ServerAuthenticationContext(this, MechanismConfigurationSelector.constantSelector(MechanismConfiguration.EMPTY)); if (principal != null) serverAuthenticationContext.setAuthenticationPrincipal(principal); if (serverAuthenticationContext.verifyEvidence(evidence)) { if (serverAuthenticationContext.authorize()) { if (evidence instanceof PasswordGuessEvidence) { PasswordGuessEvidence passwordGuessEvidence = PasswordGuessEvidence.class.cast(evidence); serverAuthenticationContext.addPrivateCredential(new PasswordCredential(ClearPassword.createRaw(ClearPassword.ALGORITHM_CLEAR, passwordGuessEvidence.getGuess()))); } else if (evidence instanceof BearerTokenEvidence) { BearerTokenEvidence tokenEvidence = BearerTokenEvidence.class.cast(evidence); serverAuthenticationContext.addPrivateCredential(new BearerTokenCredential(tokenEvidence.getToken())); } else { log.tracef("Evidence [%s] does not map to a supported credential type. Credentials are not available from authorized identity and identity propagation may not work", evidence.getClass().getName()); } serverAuthenticationContext.succeed(); return serverAuthenticationContext.getAuthorizedIdentity(); } else { serverAuthenticationContext.fail(); throw log.authenticationFailedAuthorization(); } } else { serverAuthenticationContext.fail(); throw log.authenticationFailedEvidenceVerification(); } }