@Override
	public boolean validateUser(String userId, String password, String encPass, Object encoder, Object salt) {
		if (StringUtils.isEmpty(password) || !((ShaPasswordEncoder) encoder).matches(String.valueOf(salt), password, encPass)) {
			LOG.debug("Authentication failed: password does not match stored value");

			throw new BadCredentialsException(messages.getMessage(
					"AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
		}
		return true;
	}
The default login plugin.

This retrieves the user
ngrinder-controller/src/main/java/org/ngrinder/security/DefaultLoginPlugin.java