@Override
    public boolean matches(final CharSequence rawPassword, final String encodedPassword) {
        if (StringUtils.isBlank(encodedPassword)) {
            LOGGER.warn("The encoded password provided for matching is null. Returning false");
            return false;
        }
        var providedSalt = StringUtils.EMPTY;
        val lastDollarIndex = encodedPassword.lastIndexOf('$');
        if (lastDollarIndex == -1) {
            providedSalt = encodedPassword.substring(0, 2);
            LOGGER.debug("Assuming DES UnixCrypt as no delimiter could be found in the encoded password provided");
        } else {
            providedSalt = encodedPassword.substring(0, lastDollarIndex);
            LOGGER.debug("Encoded password uses algorithm [{}]", providedSalt.charAt(1));
        }
        var encodedRawPassword = Crypt.crypt(rawPassword.toString(), providedSalt);
        var matched = StringUtils.equals(encodedRawPassword, encodedPassword);
        val msg = String.format("Provided password does %smatch the encoded password",
            BooleanUtils.toString(matched, StringUtils.EMPTY, "not "));
        LOGGER.debug(msg);
        return matched;
    }
Special note on DES UnixCrypt:
In DES UnixCrypt, so first two characters of the encoded password are the salt.
<p>
When you change your password, the {@code /bin/passwd} program selects a salt based on the time of day.
The salt is converted into a two-character string and is stored in the {@code /etc/passwd} file along with the
encrypted {@code "password."[10]} In this manner, when you type your password at login time, the same salt is used again.
UNIX stores the salt as the first two characters of the encrypted password.

@param rawPassword     the raw password as it was provided
@param encodedPassword the encoded password.
@return true/false
core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/crypto/GlibcCryptPasswordEncoder.java