Liferay uses a process to authenticate all users.  It basically calls a list of classes that extend the com.liferay.portal.struts.Action before a user authenticates and a list after authentication.  This is highly configurable using the portal.properties and portal-ext.properties file.  The following values can be changed by adding your own custom class that extends the com.liferay.portal.struts.Action class.  We actually have a class you can look at that implements this Action called com.sitescape.team.liferay.events.LoginPostAction and com.sitescape.team.liferay.events.AbstractAction.  Look for the following entries in the portal.properties file.  

login.events.pre=com.liferay.portal.events.LoginPreAction    login.events.post=com.sitescape.team.liferay.events.LoginPostAction,com.liferay.portal.events.LoginPostAction,com.liferay.portal.events.DefaultLandingPageAction

Inside the custom class you create you can use the PortalUtil class to get the information you want.

            com.liferay.portal.model.User user = PortalUtil.getUser(req);
            String password = PortalUtil.getUserPassword(req);

 I hope this helps.