@Override
	public Authentication attemptAuthentication(HttpServletRequest request,
			HttpServletResponse response) throws AuthenticationException,
			IOException, ServletException {

		if ((this.postOnly) && (!(request.getMethod().equals("POST")))) {
			throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
		}
		
		String userName = AppUtil.trim(obtainUserID(request));
		String password = AppUtil.emptyIfNull(obtainPassword(request));
		String company = AppUtil.trim(obtainCompany(request));

		if (AppUtil.isNullOrEmpty(userName) || 
		    AppUtil.isNullOrEmpty(password) ||
		    AppUtil.isNullOrEmpty(company)) {
			
			throw new BadCredentialsException("Invalid username/password");
		}
		
		userName = userName.trim();
		
		//Using custom authentication token to include extra parameter company. Instead you can use UsernamePasswordAuthenticationToken
		CustomAuthenticationToken authRequest = new CustomAuthenticationToken(userName, password, company);

		// Place the last username attempted into HttpSession for views
		HttpSession session = request.getSession(false);
		if ((session != null) || (getAllowSessionCreation())) {
			session = request.getSession(); 
			session.setAttribute("SPRING_SECURITY_LAST_USERNAME", TextEscapeUtils.escapeEntities(userName));
		}
		
		// Allow subclasses to set the "details" property
		setDetails(request, authRequest);
		
		//calling authentication manager
		CustomAuthenticationToken authentication = (CustomAuthenticationToken) super.getAuthenticationManager().authenticate(authRequest);
		
		User user = (User) authentication.getPrincipal();
		session.setAttribute(AppConstants.USER, user);
		
		//if password expired
		if (!(new Date(System.currentTimeMillis()).before(user.getPasswordExpiryDate()))) {
			
			//changing the defaultTargetUrl to force user to change password.
			request.setAttribute(CustomSimpleUrlAuthenticationSuccessHandler.DEFAULT_TARGET_ATTRIBUTE, "/changePassword");			
		}

		
		return authentication;
	}