custom Shiro realm - who does the actual authentication
<p>when sub classing shiro's <code>AuthorizingRealm</code> (or only <code>AuthenticationRealm</code>) by overriding   </p>

<pre><code>protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
}
</code></pre>

<p>Is it my job to check that the credentials provided in the AuthenticationToken actually match?</p>

<p>Or am I supposed to return the <code>AuthenticationInfo</code> with the <code>principals</code> resolved from the <code>AuthenticationToken</code> and the correct password for the given credentials and shiro will compare them on its own somewhere within the flow of the Subject.login(AuthenticationToken) call?</p>