On the login page, the security assist authenticate user server behavior.... that is the primary purpose of that server behavior.
It looks up a record in a database (generally using username and password) and will store one or more session variables associated with the record found.