Filters whether a set of user login credentials are valid.

A WP_User object is returned if the credentials authenticate a user.
WP_Error or null otherwise.

$user = apply_filters( 'authenticate', null, $username, $password );