lib/oauth.js
function (req, cb) {
        let config = req.soajs.config;

        let loginMode = config.loginMode;
        if (req.soajs.tenantOauth && req.soajs.tenantOauth.loginMode) {
            loginMode = req.soajs.tenantOauth.loginMode;
        }

        function getLocal() {
            let condition = {'userId': req.soajs.inputmaskData['username']};
            let combo = {
                collection: userCollectionName,
                condition: condition
            };
            libProduct.model.findEntry(req.soajs, combo, function (err, record) {
                if (record) {
                    let hashConfig = {
                        "hashIterations": config.hashIterations,
                        "seedLength": config.seedLength
                    };
                    if (req.soajs.servicesConfig && req.soajs.servicesConfig.oauth) {
                        if (req.soajs.servicesConfig.oauth.hashIterations && req.soajs.servicesConfig.oauth.seedLength) {
                            hashConfig = {
                                "hashIterations": req.soajs.servicesConfig.oauth.hashIterations,
                                "seedLength": req.soajs.servicesConfig.oauth.seedLength
                            };
                        }
                    }
                    coreHasher.init(hashConfig);
                    coreHasher.compare(req.soajs.inputmaskData.password, record.password, function (err, result) {
                        if (err || !result) {
                            return cb(413);
                        }

                        delete record.password;
                        if (record.tId && req.soajs.tenant) {
                            if (record.tId.toString() !== req.soajs.tenant.id) {
                                return cb(403);
                            }
                        }
                        //TODO: keys here
                        if (record) {
                            record.loginMode = loginMode;
                        }

                        return cb(null, record);
                    });
                }
                else {
                    req.soajs.log.error("Username " + req.soajs.inputmaskData['username'] + " not found");
                    return cb(401);
                }
            });
        }

        if (loginMode === 'urac') {
            let data = {
                'username': req.soajs.inputmaskData['username'],
                'password': req.soajs.inputmaskData['password']
            };
            uracDriver.login(req.soajs, data, function (errCode, record) {
                if (errCode) {
                    return cb(errCode);
                }

                if (record) {
                    record.loginMode = loginMode;
                }
                return cb(null, record);
            });
        }
        else {
            getLocal();
        }

    }
function (req, cb) {
        let config = req.soajs.config;

        let loginMode = config.loginMode;
        if (req.soajs.tenantOauth && req.soajs.tenantOauth.loginMode) {
            loginMode = req.soajs.tenantOauth.loginMode;
        }

        function getLocal() {
            let condition = {'userId': req.soajs.inputmaskData['username']};
            let combo = {
                collection: userCollectionName,
                condition: condition
            };
            libProduct.model.findEntry(req.soajs, combo, function (err, record) {
                if (record) {
                    let hashConfig = {
                        "hashIterations": config.hashIterations,
                        "seedLength": config.seedLength
                    };
                    if (req.soajs.servicesConfig && req.soajs.servicesConfig.oauth) {
                        if (req.soajs.servicesConfig.oauth.hashIterations && req.soajs.servicesConfig.oauth.seedLength) {
                            hashConfig = {
                                "hashIterations": req.soajs.servicesConfig.oauth.hashIterations,
                                "seedLength": req.soajs.servicesConfig.oauth.seedLength
                            };
                        }
                    }
                    coreHasher.init(hashConfig);
                    coreHasher.compare(req.soajs.inputmaskData.password, record.password, function (err, result) {
                        if (err || !result) {
                            return cb(413);
                        }

                        delete record.password;
                        if (record.tId && req.soajs.tenant) {
                            if (record.tId.toString() !== req.soajs.tenant.id) {
                                return cb(403);
                            }
                        }
                        //TODO: keys here
                        if (record) {
                            record.loginMode = loginMode;
                        }

                        return cb(null, record);
                    });
                }
                else {
                    req.soajs.log.error("Username " + req.soajs.inputmaskData['username'] + " not found");
                    return cb(401);
                }
            });
        }

        if (loginMode === 'urac') {
            let data = {
                'username': req.soajs.inputmaskData['username'],
                'password': req.soajs.inputmaskData['password']
            };
            uracDriver.login(req.soajs, data, function (errCode, record) {
                if (errCode) {
                    return cb(errCode);
                }

                if (record) {
                    record.loginMode = loginMode;
                }
                return cb(null, record);
            });
        }
        else {
            getLocal();
        }

    }
Get the user record from the database, and validate password