@Override
  protected void onUnsuccessfulAuthentication(HttpServletRequest servletRequest,
                                              HttpServletResponse servletResponse,
                                              AuthenticationException authException) throws IOException {
    if (eventHandler != null) {
      AmbariAuthenticationException cause;
      if (authException instanceof AmbariAuthenticationException) {
        cause = (AmbariAuthenticationException) authException;
      } else {
        String header = servletRequest.getHeader("Authorization");
        String username = null;
        try {
          username = getUsernameFromAuth(header, getCredentialsCharset(servletRequest));
        } catch (Exception e) {
          LOG.warn("Error occurred during decoding authorization header.", e);
        }

        cause = new AmbariAuthenticationException(username, authException.getMessage(), false, authException);
      }

      eventHandler.onUnsuccessfulAuthentication(this, servletRequest, servletResponse, cause);
    }
  }
In the case of invalid username or password, the authentication fails and it is logged

@param servletRequest  the request
@param servletResponse the response
@param authException   the exception, if any, causing the unsuccessful authentication attempt
@throws IOException
ambari-server/src/main/java/org/apache/ambari/server/security/authentication/AmbariBasicAuthenticationFilter.java