server/src/main/java/com/orientechnologies/orient/server/network/protocol/http/command/post/OServerCommandPostAuthToken.java
protected String authenticate(final String username, final String password, final String iDatabaseName) throws IOException {
    ODatabaseDocument db = null;
    String userRid = null;
    try {
      db = (ODatabaseDocument) server.openDatabase(iDatabaseName, username, password);

      userRid = (db.getUser() == null ? "<server user>" : db.getUser().getDocument().getIdentity().toString());
    } catch (OSecurityAccessException e) {
      // WRONG USER/PASSWD
    } catch (OLockException e) {
      OLogManager.instance().error(this, "Cannot access to the database '" + iDatabaseName + "'", e);
    } finally {
      if (db != null) {
        db.close();
      }
    }
    return userRid;
  }
protected String authenticate(final String username, final String password, final String iDatabaseName) throws IOException {
    ODatabaseDocument db = null;
    String userRid = null;
    try {
      db = (ODatabaseDocument) server.openDatabase(iDatabaseName, username, password);

      userRid = (db.getUser() == null ? "<server user>" : db.getUser().getDocument().getIdentity().toString());
    } catch (OSecurityAccessException e) {
      // WRONG USER/PASSWD
    } catch (OLockException e) {
      OLogManager.instance().error(this, "Cannot access to the database '" + iDatabaseName + "'", e);
    } finally {
      if (db != null) {
        db.close();
      }
    }
    return userRid;
  }
null is returned in all other cases and means authentication was unsuccessful.