/* see superclass */
  @Override
  public User authenticate(String username, String password) throws Exception {
    // Check username and password are not null
    if (username == null || username.isEmpty()) throw new LocalException("Invalid username: null");
    if (password == null || password.isEmpty()) throw new LocalException("Invalid password: null");

    Properties config = ConfigUtility.getConfigProperties();

    if (handler == null) {
      timeout = Integer.valueOf(config.getProperty("security.timeout"));
      String handlerName = config.getProperty("security.handler");
      handler =
          ConfigUtility.newStandardHandlerInstanceWithConfiguration(
              "security.handler", handlerName, SecurityServiceHandler.class);
    }

    //
    // Call the security service
    //
    User authUser = handler.authenticate(username, password);
    return authHelper(authUser);
  }