public function authenticateUser($username, $password, array $status)
    {
        if (empty($password)) {
            return null;
        }

        // allow login either through username or email
        if (preg_match('/' . BackendSchema\User::NAME_PATTERN . '/', $username)) {
            $column = 'name';
        } else {
            $column = 'email';
        }

        $condition = new Condition();
        $condition->equals($column, $username);
        $condition->in('status', $status);

        $user = $this->userTable->getOneBy($condition);

        if (!empty($user)) {
            // we can authenticate only local users
            if ($user['provider'] != ProviderInterface::PROVIDER_SYSTEM) {
                return null;
            }

            if ($user['status'] == Table\User::STATUS_DISABLED) {
                throw new StatusCode\BadRequestException('The assigned account is disabled');
            }

            if ($user['status'] == Table\User::STATUS_DELETED) {
                throw new StatusCode\BadRequestException('The assigned account is deleted');
            }

            // check password
            if (password_verify($password, $user['password'])) {
                return $user['id'];
            } else {
                $this->eventDispatcher->dispatch(UserEvents::FAIL_AUTHENTICATION, new FailedAuthenticationEvent(UserContext::newContext($user['id'])));
            }
        }

        return null;
    }