If your userstore contains alias users and if you have configured alias class for authentication, the authentication fails. For the workaround, see TID 7015163.