code:     public Authentication authenticate(Authentication req) throws AuthenticationException {
          logger.debug("Processing authentication request for " + req.getName());
  
          if (req.getCredentials() == null) {
              BadCredentialsException e = new BadCredentialsException("No password supplied");
              publish(new AuthenticationFailureBadCredentialsEvent(req, e));
              throw e;
          }
  
          UaaUser user;
          boolean passwordMatches = false;
          user = getUaaUser(req);
          if (user!=null) {
              passwordMatches =
                  ((CharSequence) req.getCredentials()).length() != 0 && encoder.matches((CharSequence) req.getCredentials(), user.getPassword());
          } else {
              user = dummyUser;
          }
  
          if (!accountLoginPolicy.isAllowed(user, req)) {
              logger.warn("Login policy rejected authentication for " + user.getUsername() + ", " + user.getId()
                              + ". Ignoring login request.");
              AuthenticationPolicyRejectionException e = new AuthenticationPolicyRejectionException("Login policy rejected authentication");
              publish(new AuthenticationFailureLockedEvent(req, e));
              throw e;
          }
  
          if (passwordMatches) {
              logger.debug("Password successfully matched for userId["+user.getUsername()+"]:"+user.getId());
  
              if (!allowUnverifiedUsers && !user.isVerified()) {
                  publish(new UnverifiedUserAuthenticationEvent(user, req));
                  logger.debug("Account not verified: " + user.getId());
                  throw new AccountNotVerifiedException("Account not verified");
              }
  
              int expiringPassword = getPasswordExpiresInMonths();
              if (expiringPassword>0) {
                  Calendar cal = Calendar.getInstance();
                  cal.setTimeInMillis(user.getPasswordLastModified().getTime());
                  cal.add(Calendar.MONTH, expiringPassword);
                  if (cal.getTimeInMillis() < System.currentTimeMillis()) {
                      throw new PasswordExpiredException("Your current password has expired. Please reset your password.");
                  }
              }
  
              Authentication success = new UaaAuthentication(new UaaPrincipal(user),
                              user.getAuthorities(), (UaaAuthenticationDetails) req.getDetails());
              publish(new UserAuthenticationSuccessEvent(user, success));
  
              return success;
          }
  
          if (user == dummyUser || user == null) {
              logger.debug("No user named '" + req.getName() + "' was found for origin:"+ origin);
              publish(new UserNotFoundEvent(req));
          } else {
              logger.debug("Password did not match for user " + req.getName());
              publish(new UserAuthenticationFailureEvent(user, req));
          }
          BadCredentialsException e = new BadCredentialsException("Bad credentials");
          publish(new AuthenticationFailureBadCredentialsEvent(req, e));
          throw e;
      }
  
  