String password = String.valueOf(((PasswordCallback) callbacks[1]).getPassword());
// Here we validate the credentials against some
// authentication/authorization provider.
User user = userDatabase.findUser(username);
if (user != null && user.getPassword().equals(password)) {
// We store the username and roles
// fetched from the credentials provider
// to be used later in commit() method.
login = username;
Iterator<Role> roles = user.getRoles();
while(roles.hasNext()) {
Role role = roles.next();
userGroups.add(role.getName());
}