code:     public synchronized Principal authenticate(Connection dbConnection,
                                                 String username,
                                                 String credentials) {
          // No user or no credentials
          // Can't possibly authenticate, don't bother the database then
          if (username == null || credentials == null) {
              if (containerLog.isTraceEnabled())
                  containerLog.trace(sm.getString("jdbcRealm.authenticateFailure",
                                                  username));
              return null;
          }
  
          // Look up the user's credentials
          String dbCredentials = getPassword(username);
  
          if (dbCredentials == null) {
              // User was not found in the database.
  
              if (containerLog.isTraceEnabled())
                  containerLog.trace(sm.getString("jdbcRealm.authenticateFailure",
                                                  username));
              return null;
          }
  
          // Validate the user's credentials
          boolean validated = getCredentialHandler().matches(credentials, dbCredentials);
  
          if (validated) {
              if (containerLog.isTraceEnabled())
                  containerLog.trace(sm.getString("jdbcRealm.authenticateSuccess",
                                                  username));
          } else {
              if (containerLog.isTraceEnabled())
                  containerLog.trace(sm.getString("jdbcRealm.authenticateFailure",
                                                  username));
              return null;
          }
  
          ArrayList<String> roles = getRoles(username);
  
          // Create and return a suitable Principal for this user
          return (new GenericPrincipal(username, credentials, roles));
      }
  
  
      /**
       * Close the specified database connection.
       *
       * @param dbConnection The connection to be closed
       */
  