if (authenticator == null)
throw new LoginException("No Authenticator component found, check your configuration");
Credential[] credentials =
new Credential[]{new UsernameCredential(username), new PasswordCredential(password)};
String userId = authenticator.validateUser(credentials);
identity = authenticator.createIdentity(userId);
sharedState.put("javax.security.auth.login.name", userId);
// TODO use PasswordCredential wrapper