How does Django ModelBackend.authenticate work?
<p>I am looking into the <a href="https://github.com/django/django/blob/master/django/contrib/auth/backends.py" rel="nofollow">ModelBackend</a>. </p>

<pre><code>def authenticate(self, username=None, password=None, **kwargs):
    UserModel = get_user_model()
    if username is None:
        username = kwargs.get(UserModel.USERNAME_FIELD)
    try:
        user = UserModel._default_manager.get_by_natural_key(username)
    except UserModel.DoesNotExist:
        # Run the default password hasher once to reduce the timing
        # difference between an existing and a non-existing user (#20760).
        UserModel().set_password(password)
    else:
        if user.check_password(password) and self.user_can_authenticate(user):
            return user
</code></pre>

<p>I am confused.</p>

<ol>
<li>Where is <code>authenticate()</code> is called.</li>
<li>What is passing <code>username</code> and <code>password</code> to <code>authenticate()</code>?</li>
</ol>

<p>Sometimes, the code works, but I have no idea how it works.</p>

<p><strong>UPDATE</strong></p>

<p>I am reading the source code of one project. I found the definition of <code>authenticate()</code>, but I cannot find where it is called. </p>

<pre><code>grep -r "authenticate" .

./src/myproject/views.py:   if request.user.is_authenticated():
./src/lib/backend.py:   def authenticate(self, username = None, password = None, **kwargs):
./src/lib/middleware.py:        if not request.user.is_authenticated():
./src/lib/decorators.py:        if request.user.is_authenticated():
</code></pre>