robe-admin/src/main/java/io/robe/admin/resources/AuthResource.java
@POST
    @UnitOfWork(flushMode = FlushMode.ALWAYS)
    @Path("login")
    @Timed
    public Response login(@Context HttpServletRequest request, Map<String, String> credentials) throws Exception {

        Optional<User> user = userDao.findByUsername(credentials.get("username"));
        if (!user.isPresent()) {
            throw new WebApplicationException(Response.Status.UNAUTHORIZED);
        } else if (user.get().getPassword().equals(credentials.get("password"))) {
            if (!user.get().isActive())
                return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity("User blocked.").build();
            Map<String, String> attributes = new HashMap<>();
            attributes.put("userAgent", request.getHeader("User-Agent"));
            attributes.put("remoteAddr", request.getRemoteAddr());


            BasicToken token = new BasicToken(user.get().getUserId(), user.get().getEmail(), DateTime.now(), attributes);
            token.setExpiration(token.getMaxAge());
            credentials.remove("password");
            credentials.put("domain", TokenBasedAuthResponseFilter.getTokenSentence(null));

            user.get().setLastLoginTime(DateTime.now().toDate());
            user.get().setFailCount(0);

            logAction(new ActionLog("LOGIN", null, user.get().toString(), true, request.getRemoteAddr()));

            return Response.ok().header("Set-Cookie", TokenBasedAuthResponseFilter.getTokenSentence(token)).entity(credentials).build();
        } else {
            if (!user.get().isActive()) {
                logAction(new ActionLog("LOGIN", "Blocked", user.get().toString(), false, request.getRemoteAddr()));
                return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity("User blocked.").build();
            }
            int failCount = user.get().getFailCount() + 1;
            user.get().setFailCount(failCount);
            boolean block = failCount >= Integer.valueOf((String) SystemParameterCache.get("USER_BLOCK_FAIL_LIMIT", "3"));
            if (block)
                user.get().setActive(false);

            userDao.update(user.get());
            logAction(new ActionLog("LOGIN", "Wrong Password", user.get().toString(), false, request.getRemoteAddr()));

            return Response.status(Response.Status.UNAUTHORIZED).build();
        }
    }
@POST
    @UnitOfWork(flushMode = FlushMode.ALWAYS)
    @Path("login")
    @Timed
    public Response login(@Context HttpServletRequest request, Map<String, String> credentials) throws Exception {

        Optional<User> user = userDao.findByUsername(credentials.get("username"));
        if (!user.isPresent()) {
            throw new WebApplicationException(Response.Status.UNAUTHORIZED);
        } else if (user.get().getPassword().equals(credentials.get("password"))) {
            if (!user.get().isActive())
                return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity("User blocked.").build();
            Map<String, String> attributes = new HashMap<>();
            attributes.put("userAgent", request.getHeader("User-Agent"));
            attributes.put("remoteAddr", request.getRemoteAddr());


            BasicToken token = new BasicToken(user.get().getUserId(), user.get().getEmail(), DateTime.now(), attributes);
            token.setExpiration(token.getMaxAge());
            credentials.remove("password");
            credentials.put("domain", TokenBasedAuthResponseFilter.getTokenSentence(null));

            user.get().setLastLoginTime(DateTime.now().toDate());
            user.get().setFailCount(0);

            logAction(new ActionLog("LOGIN", null, user.get().toString(), true, request.getRemoteAddr()));

            return Response.ok().header("Set-Cookie", TokenBasedAuthResponseFilter.getTokenSentence(token)).entity(credentials).build();
        } else {
            if (!user.get().isActive()) {
                logAction(new ActionLog("LOGIN", "Blocked", user.get().toString(), false, request.getRemoteAddr()));
                return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity("User blocked.").build();
            }
            int failCount = user.get().getFailCount() + 1;
            user.get().setFailCount(failCount);
            boolean block = failCount >= Integer.valueOf((String) SystemParameterCache.get("USER_BLOCK_FAIL_LIMIT", "3"));
            if (block)
                user.get().setActive(false);

            userDao.update(user.get());
            logAction(new ActionLog("LOGIN", "Wrong Password", user.get().toString(), false, request.getRemoteAddr()));

            return Response.status(Response.Status.UNAUTHORIZED).build();
        }
    }
check username and password for authentication
<p>
Status Code:
UNAUTHORIZED no have authentication.
INTERNAL_SERVER_ERROR Blocked.

@param request     HttpServletRequest
@param credentials username and password (SHA256)
@return {@link Response}
@throws Exception for createToken