*/
@Override
protected Authentication getAuthentication(Principal principal, Credentials creds) throws RepositoryException {
if (!disableTokenAuth && tokenCredentials != null) {
Authentication authentication = new TokenBasedAuthentication(tokenCredentials.getToken(), tokenExpiration, session);
if (authentication.canHandle(creds)) {
return authentication;
}
}
if (user != null) {