diff --git a/znc.cpp b/znc.cpp
index ff4d2815..18601276 100644
--- a/znc.cpp
+++ b/znc.cpp
@@ -1693,6 +1693,35 @@ void CZNC::UpdateTrafficStats() {
 	}
 }
 
+void CZNC::AuthUser(CSmartPtr<CAuthBase> AuthClass) {
+#ifdef _MODULES
+	// TODO unless the auth module calls it, CUser::IsHostAllowed() is not honoured
+	if (GetModules().OnLoginAttempt(AuthClass)) {
+		return;
+	}
+#endif
+
+	CUser* pUser = GetUser(AuthClass->GetUsername());
+
+	if (!pUser || !pUser->CheckPass(AuthClass->GetPassword())) {
+		if (pUser) {
+			pUser->PutStatus("Another client attempted to login as you, with a bad password.");
+		}
+
+		AuthClass->RefuseLogin("Invalid Password");
+		return;
+	}
+
+	CString sHost = AuthClass->GetRemoteIP();
+
+	if (!pUser->IsHostAllowed(sHost)) {
+		AuthClass->RefuseLogin("Your host [" + sHost + "] is not allowed");
+		return;
+	}
+
+	AuthClass->AcceptLogin(*pUser);
+}
+
 class CConnectUserTimer : public CCron {
 public:
 	CConnectUserTimer(int iSecs) : CCron() {
diff --git a/znc.h b/znc.h
index 37e81aa4..26474a7a 100644
--- a/znc.h
+++ b/znc.h
@@ -126,6 +126,11 @@ public:
 	unsigned long long BytesWritten() const { return m_uBytesWritten; }
 	void UpdateTrafficStats();
 
+	// Authenticate a user.
+	// The result is passed back via callbacks to CAuthBase.
+	// CSmartPtr handles freeing this pointer!
+	void AuthUser(CSmartPtr<CAuthBase> AuthClass);
+
 	// Setters
 	void SetNeedRehash(bool b) { m_bNeedRehash = b; }
 	void SetStatusPrefix(const CString& s) { m_sStatusPrefix = (s.empty()) ? "*" : s; }