private DirContextOperations authenticate(UsernamePasswordAuthenticationToken authentication) {
    DirContextOperations user = null;

    String username = authentication.getName();
    Object credentials = authentication.getCredentials();
    String password = (credentials instanceof String) ? (String) credentials : null;

    if (StringUtils.isEmpty(username)) {
      LOG.debug("Empty username encountered - failing authentication.");
      throw new BadCredentialsException("Empty username encountered.");
    }

    LOG.debug("Authenticating {}", username);

    if (StringUtils.isEmpty(password)) {
      LOG.debug("Empty password encountered - failing authentication.");
      throw new BadCredentialsException("Empty password encountered.");
    }

    LdapUserSearch userSearch = getUserSearch();
    if (userSearch == null) {
      LOG.debug("The user search facility has not been set - failing authentication.");
      throw new BadCredentialsException("The user search facility has not been set.");
    } else {
      if (LOG.isTraceEnabled()) {
        LOG.trace("Searching for user with username {}: {}", username, userSearch);
      }

      // Find the user data where the supplied username matches the value of the configured LDAP
      // attribute for the user's username. If a user is found, use the DN fro the returned data
      // and the supplied password to attempt authentication.
      DirContextOperations userFromSearch = userSearch.searchForUser(username);

      if (userFromSearch == null) {
        LOG.debug("LDAP user object not found for {}", username);
      } else {
        LOG.debug("Found LDAP user for {}: {}", username, userFromSearch.getDn());
        user = bind(userFromSearch, password);

        // If trace enabled, log the user's LDAP attributes.
        if (LOG.isTraceEnabled()) {
          Attributes attributes = user.getAttributes();
          if (attributes != null) {
            StringBuilder builder = new StringBuilder();
            NamingEnumeration<String> ids = attributes.getIDs();
            try {
              while (ids.hasMore()) {
                String id = ids.next();
                builder.append("\n\t");
                builder.append(attributes.get(id));
              }
            } catch (NamingException e) {
              // Ignore this...
            }
            LOG.trace("User Attributes: {}", builder);
          } else {
            LOG.trace("User Attributes: not available");
          }
        }
      }
    }

    // If a user was not authenticated, thrown a BadCredentialsException, else return the user data
    if (user == null) {
      LOG.debug("Invalid credentials for {} - failing authentication.", username);
      throw new BadCredentialsException("Invalid credentials.");
    } else {
      LOG.debug("Successfully authenticated {}", username);
    }

    return user;
  }
Authenticates a user with a configured LDAP server using the user's username and password.
<p>
To authenticate a user:
<ol>
<li>
The LDAP server is queried for the relevant user object where the
supplied username matches the configured LDAP attribute that represents the user's username
<ul><li>Example: (&(uid=user1)(objectClass=posixAccount))</li></ul>
</li>
<li>
If found, the distinguished name (DN) of the user object is obtained from returned data and then
used, along with the supplied password to perform an LDAP bind (see {@link #bind(DirContextOperations, String)})
</li>
</ol>
<p>
Failure to authenticate will result in a {@link BadCredentialsException} to be thrown.

@param authentication the credentials to use for authentication
@return the authenticated user details
@see #bind(DirContextOperations, String)
ambari-server/src/main/java/org/apache/ambari/server/security/authorization/AmbariLdapBindAuthenticator.java