core-bundle/src/Security/Authentication/FrontendPreviewAuthenticator.php
private function loadFrontendUser(string $username, BackendUser $backendUser): ?FrontendUser
    {
        try {
            $frontendUser = $this->userProvider->loadUserByUsername($username);

            // Make sure the user provider returned a front end user
            if (!$frontendUser instanceof FrontendUser) {
                throw new UsernameNotFoundException('User is not a front end user');
            }
        } catch (UsernameNotFoundException $e) {
            if (null !== $this->logger) {
                $this->logger->info(
                    sprintf('Could not find a front end user with the username "%s"', $username),
                    ['contao' => new ContaoContext(__METHOD__, ContaoContext::ACCESS, '')]
                );
            }

            return null;
        }

        $allowedGroups = StringUtil::deserialize($backendUser->amg, true);
        $frontendGroups = StringUtil::deserialize($frontendUser->groups, true);

        // The front end user does not belong to a group that the back end user is allowed to log in
        if (!$backendUser->isAdmin && !\count(array_intersect($frontendGroups, $allowedGroups))) {
            return null;
        }

        return $frontendUser;
    }
private function loadFrontendUser(string $username, BackendUser $backendUser): ?FrontendUser
    {
        try {
            $frontendUser = $this->userProvider->loadUserByUsername($username);

            // Make sure the user provider returned a front end user
            if (!$frontendUser instanceof FrontendUser) {
                throw new UsernameNotFoundException('User is not a front end user');
            }
        } catch (UsernameNotFoundException $e) {
            if (null !== $this->logger) {
                $this->logger->info(
                    sprintf('Could not find a front end user with the username "%s"', $username),
                    ['contao' => new ContaoContext(__METHOD__, ContaoContext::ACCESS, '')]
                );
            }

            return null;
        }

        $allowedGroups = StringUtil::deserialize($backendUser->amg, true);
        $frontendGroups = StringUtil::deserialize($frontendUser->groups, true);

        // The front end user does not belong to a group that the back end user is allowed to log in
        if (!$backendUser->isAdmin && !\count(array_intersect($frontendGroups, $allowedGroups))) {
            return null;
        }

        return $frontendUser;
    }
Loads the front end user and checks its group access permissions.