Source:
protected void processAuthenticationResponse(HttpServletRequest request, HttpServletResponse response, AuthenticationContext context) throws AuthenticationFailedException { String headerValue = (String) request.getSession().getAttribute(AUTHORIZATION_HEADER_NAME); String credential = null; if (headerValue != null) { credential = headerValue.trim().split(" ")[1]; } else { credential = request.getParameter("sectoken"); } try { String credentials = new String(Base64.decode(credential)); String username = credentials.substring(0, credentials.indexOf(":")); String password = credentials.substring(credentials.indexOf(":") + 1); if (StringUtils.isBlank(username) || StringUtils.isBlank(password)) { throw new AuthenticationFailedException("username and password cannot be empty"); } int tenantId = IdentityUtil.getTenantIdOFUser(username); UserStoreManager userStoreManager = (UserStoreManager) BasicAuthRequestPathAuthenticatorServiceComponent.getRealmService().getTenantUserRealm(tenantId).getUserStoreManager(); boolean isAuthenticated = userStoreManager.authenticate(MultitenantUtils.getTenantAwareUsername(username), password); if (!isAuthenticated) { log.error("Authentication failed for user " + username); throw new AuthenticationFailedException("Authentication Failed"); } if (log.isDebugEnabled()) { log.debug("Authenticated user " + username); } Map<String, Object> authProperties = context.getProperties(); String tenantDomain = MultitenantUtils.getTenantDomain(username); if (authProperties == null) { authProperties = new HashMap<String, Object>(); context.setProperties(authProperties); } authProperties.put("user-tenant-domain", tenantDomain); context.setSubject(AuthenticatedUser.createLocalAuthenticatedUserFromSubjectIdentifier( FrameworkUtils.prependUserStoreDomainToName( username))); } catch (Exception e) { log.error(e.getMessage(), e); throw new AuthenticationFailedException("Authentication Failed"); } }

Target:
protected void processAuthenticationResponse(HttpServletRequest request, HttpServletResponse response, AuthenticationContext context) throws AuthenticationFailedException { String headerValue = (String) request.getSession().getAttribute(AUTHORIZATION_HEADER_NAME); String credential = null; if (headerValue != null) { credential = headerValue.trim().split(" ")[1]; } else { credential = request.getParameter("sectoken"); } try { String credentials = new String(Base64.decode(credential)); String username = credentials.substring(0, credentials.indexOf(":")); String password = credentials.substring(credentials.indexOf(":") + 1); if (StringUtils.isBlank(username) || StringUtils.isBlank(password)) { throw new AuthenticationFailedException("username and password cannot be empty"); } int tenantId = IdentityUtil.getTenantIdOFUser(username); UserStoreManager userStoreManager = (UserStoreManager) BasicAuthRequestPathAuthenticatorServiceComponent.getRealmService().getTenantUserRealm(tenantId).getUserStoreManager(); boolean isAuthenticated = userStoreManager.authenticate(MultitenantUtils.getTenantAwareUsername(username), password); if (!isAuthenticated) { throw new AuthenticationFailedException("Authentication Failed"); } if (log.isDebugEnabled()) { log.debug("Authenticated user " + username); } Map<String, Object> authProperties = context.getProperties(); String tenantDomain = MultitenantUtils.getTenantDomain(username); if (authProperties == null) { authProperties = new HashMap<String, Object>(); context.setProperties(authProperties); } authProperties.put("user-tenant-domain", tenantDomain); context.setSubject(AuthenticatedUser.createLocalAuthenticatedUserFromSubjectIdentifier( FrameworkUtils.prependUserStoreDomainToName(username))); } catch (Exception e) { log.error(e.getMessage(), e); throw new AuthenticationFailedException("Authentication Failed"); } }