Some of the functions are in wp-includes/pluggable.php
, notably wp_authenticate()
though you’ll notice that most of the work is done by filters hooked to authenticate
. The names of those you can find in wp-includes/default-filters.php
and the function definitions in wp-includes/user.php
.
But be aware that functions in pluggables.php
can be replaced by theme or plugin code in their entirety and functions hooked to authenticate
can be removed and replaced as well as altered via the numerous hooks provided by the various functions.