@Override
  public Subject authenticate(Object credentials) {
    String username;
    Properties credProps = new Properties();
    if (credentials instanceof String[]) {
      final String[] aCredentials = (String[]) credentials;
      username = aCredentials[0];
      credProps.setProperty(ResourceConstants.USER_NAME, aCredentials[0]);
      credProps.setProperty(ResourceConstants.PASSWORD, aCredentials[1]);
    } else if (credentials instanceof String) {
      username = "token-" + credentials.hashCode();
      credProps.setProperty(ResourceConstants.TOKEN, (String) credentials);
    } else {
      throw new AuthenticationFailedException(MISSING_CREDENTIALS_MESSAGE);
    }

    org.apache.shiro.subject.Subject shiroSubject = securityService.login(credProps);
    Principal principal;

    if (shiroSubject == null) {
      principal = new JMXPrincipal(username);
    } else {
      principal = new ShiroPrincipal(shiroSubject);
    }

    return new Subject(true, Collections.singleton(principal), Collections.emptySet(),
        Collections.emptySet());
  }
this will make JMX authentication to use Shiro for Authentication
geode-core/src/main/java/org/apache/geode/internal/security/shiro/JMXShiroAuthenticator.java