>> Also, which IdP module implements the form-based username/password lookup? > > The code is radically decomposed and is built out of Spring Web Flows that wire up small pieces of code. The authn/Password webflow is the one that does password authentication. The SWF flow referred to is : system/flows/authn/password-authn-flow.xml, HTH.