public function authenticateToken(TokenInterface $token, UserProviderInterface $userProvider, $providerKey)
    {
        if (!$this->secret) {
            throw new \LogicException('Config does not contain a secret.');
        }

        if ((null === ($credentials = $token->getCredentials())) || !is_object($credentials)) {
            throw new AuthenticationException(sprintf('Invalid token - no or invalid credentials.'));
        }

        // Get the user for the injected UserProvider
        $user = $userProvider->loadUserByUsername($credentials->username);

        if (!$user) {
            throw new AuthenticationException(sprintf('Invalid token - could not derive user from credentials.'));
        }

        return new JavascriptWebToken($credentials, $providerKey, $user, $user->getRoles());
    }