loginmodules/password/authenticators/jdbc/src/main/java/org/beiter/michael/authn/jaas/loginmodules/password/authenticators/jdbc/JdbcPasswordAuthenticator.java
@edu.umd.cs.findbugs.annotations.SuppressWarnings("SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING")
    private UserRecord getUserRecord(final String domain, final String userName)
            throws LoginException {

        String userId;
        String credential;

        Connection connection = null;
        PreparedStatement statement = null;
        ResultSet resultSet = null;

        try {
            connection = getDatabaseConnection();

            statement = connection.prepareStatement(dbProps.get().getSqlUserQuery());
            statement.setString(1, domain);
            statement.setString(2, userName);

            resultSet = statement.executeQuery();

            if (resultSet.next()) {
                userId = resultSet.getString(1);
                credential = resultSet.getString(2);
            } else {
                final String error = "Username '" + userName + "' does not exist (query returned zero results)";
                LOG.warn(error);
                throw new LoginException(error);
            }

            resultSet.close();
            statement.close();
        } catch (SQLException e) {
            final String error = "Error executing SQL query";
            LOG.warn(error, e);
            throw Util.newLoginException(error, e);
        } finally {
            DbUtil.close(resultSet);
            DbUtil.close(statement);
            DbUtil.close(connection);
        }

        return new UserRecord(domain, userName, userId, credential);
    }
@edu.umd.cs.findbugs.annotations.SuppressWarnings("SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING")
    private UserRecord getUserRecord(final String domain, final String userName)
            throws LoginException {

        String userId;
        String credential;

        Connection connection = null;
        PreparedStatement statement = null;
        ResultSet resultSet = null;

        try {
            connection = getDatabaseConnection();

            statement = connection.prepareStatement(dbProps.get().getSqlUserQuery());
            statement.setString(1, domain);
            statement.setString(2, userName);

            resultSet = statement.executeQuery();

            if (resultSet.next()) {
                userId = resultSet.getString(1);
                credential = resultSet.getString(2);
            } else {
                final String error = "Username '" + userName + "' does not exist (query returned zero results)";
                LOG.warn(error);
                throw new LoginException(error);
            }

            resultSet.close();
            statement.close();
        } catch (SQLException e) {
            final String error = "Error executing SQL query";
            LOG.warn(error, e);
            throw Util.newLoginException(error, e);
        } finally {
            DbUtil.close(resultSet);
            DbUtil.close(statement);
            DbUtil.close(connection);
        }

        return new UserRecord(domain, userName, userId, credential);
    }
The SQL statement is retrieved from the configuration, and the admin is trusted