<p>An <tt>AuthenticationToken</tt> is a consolidation of an account's principals and supporting credentials submitted by a user during an authentication attempt. <p/> <p>The token is submitted to an {@link Authenticator Authenticator} via the {@link Authenticator#authenticate(AuthenticationToken) authenticate(token)} method. The Authenticator then executes the authentication/log-in process. <p/> <p>Common implementations of an <tt>AuthenticationToken</tt> would have username/password pairs, X.509 Certificate, PGP key, or anything else you can think of. The token can be anything needed by an {@link Authenticator} to authenticate properly. <p/> <p>Because applications represent user data and credentials in different ways, implementations of this interface are application-specific. You are free to acquire a user's principals and credentials however you wish (e.g. web form, Swing form, fingerprint identification, etc) and then submit them to the Shiro framework in the form of an implementation of this interface. <p/> <p>If your application's authentication process is username/password based (like most), instead of implementing this interface yourself, take a look at the {@link UsernamePasswordToken UsernamePasswordToken} class, as it is probably sufficient for your needs. <p/> <p>RememberMe services are enabled for a token if they implement a sub-interface of this one, called {@link RememberMeAuthenticationToken RememberMeAuthenticationToken}. Implement that interface if you need RememberMe services (the <tt>UsernamePasswordToken</tt> already implements this interface). <p/> <p>If you are familiar with JAAS, an <tt>AuthenticationToken</tt> replaces the concept of a {@link javax.security.auth.callback.Callback}, and defines meaningful behavior (<tt>Callback</tt> is just a marker interface, and of little use). We also think the name <em>AuthenticationToken</em> more accurately reflects its true purpose in a login framework, whereas <em>Callback</em> is less obvious.