credentials.setCredential(new Password(password));
credentialMatcher.validate(user, password);
if (credentialMatcher.hasExpired()) {
throw new AeroGearSecurityException(HttpStatus.CREDENTIAL_HAS_EXPIRED);
} else if (identity.login() != Identity.AuthenticationResult.SUCCESS) {
throw new AeroGearSecurityException(HttpStatus.AUTHENTICATION_FAILED);
}
return true;
}