* @return <code>true</code> if the user was authenticated, <code>false</code> otherwise.
*/
protected boolean authenticate(AccreditableManager accreditableManager, String username,
String password, Identity identity) throws AccessControlException {
User user = accreditableManager.getUserManager().getUser(username);
if (getLogger().isDebugEnabled()) {
getLogger().debug("Authenticating user: [" + user + "]");
}
boolean authenticated = false;
if (user != null && user.authenticate(password)) {
if (getLogger().isDebugEnabled()) {
getLogger().debug("User [" + user + "] authenticated.");
}
if (!identity.contains(user)) {
User oldUser = identity.getUser();
if (oldUser != null) {
if (getLogger().isDebugEnabled()) {
getLogger().debug("Removing user [" + oldUser + "] from identity.");
}
identity.removeIdentifiable(oldUser);