public Subject login(Subject subject, AuthenticationToken token) throws AuthenticationException {
        AuthenticationInfo info;
        try {
            info = authenticate(token);
        } catch (AuthenticationException ae) {
            try {
                onFailedLogin(token, ae, subject);
            } catch (Exception e) {
                if (LOGGER.isInfoEnabled()) {
                    LOGGER.info("onFailedLogin method threw an "
                            + "exception.  Logging and propagating original AuthenticationException.", e);
                }
            }
            //propagate
            throw ae;
        }

        Subject loggedIn = createSubject(token, info, subject);

        onSuccessfulLogin(token, info, loggedIn);

        return loggedIn;
    }
First authenticates the {@code AuthenticationToken} argument, and if successful, constructs a
{@code Subject} instance representing the authenticated account's identity.
<p/>
Once constructed, the {@code Subject} instance is then {@link #bind bound} to the application for
subsequent access before being returned to the caller.

@param token the authenticationToken to process for the login attempt.
@return a Subject representing the authenticated user.
@throws AuthenticationException if there is a problem authenticating the specified {@code token}.
core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java