in src/main/java/org/apache/sling/jcr/filetransfer/sftp/internal/JcrFileSystemFactory.java [95:99]
private Session createUserSession(final String username) throws RepositoryException {
final Session session = slingRepository.loginAdministrative(null);
final Credentials credentials = new SimpleCredentials(username, "".toCharArray());
return session.impersonate(credentials);
}