If you want to validate a username/password authn attempt against a cache, then yes the username and password have to be someone in the mix.