@Override
  /*
   * these following users will be authenticated:
   * 1. auth token defined as SimpleSecurityManager.VALID_TOKEN
   * 2. username and password that are the same
   */
  public Object authenticate(final Properties credentials) throws AuthenticationFailedException {
    String token = credentials.getProperty(TOKEN);
    if (token != null) {
      if (VALID_TOKEN.equalsIgnoreCase(token) || token.length() > 20) {
        return "Bearer " + token;
      } else {
        throw new AuthenticationFailedException("Invalid token");
      }
    }
    String username = credentials.getProperty(USER_NAME);
    String password = credentials.getProperty(PASSWORD);
    if (username != null && username.equals(password)) {
      return username;
    }
    throw new AuthenticationFailedException("invalid username/password");
  }
the valid token string that will be authenticated. Any other token string will be rejected.
geode-core/src/main/java/org/apache/geode/examples/SimpleSecurityManager.java