Base class:

public abstract class AuthenticationMethod implements Describable<AuthenticationMethod>, Serializable  {

    private static final long serialVersionUID = -6077120270692721571L;

    public abstract String getType();

    public boolean isAuthenticationMethod(String method) {
        return getType().equalsIgnoreCase(method);
    }

    public abstract static class AuthenticationMethodDescriptor extends Descriptor<AuthenticationMethod> {

        public static ExtensionList<AuthenticationMethodDescriptor> all() {
            return Jenkins.getInstance().getExtensionList(AuthenticationMethodDescriptor.class);
        }
    }
}

User authentication class:

public class UsernameAuthenticationMethod extends AuthenticationMethod  {
    private static final long serialVersionUID = 452156745621333923L;

    private String username;
    private Secret password;

    @DataBoundConstructor
    public UsernameAuthenticationMethod(String username, Secret password) {
        this.setUsername(username);
        this.setPassword(password);
    }

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public Secret getPassword() {
        return password;
    }

    public void setPassword(Secret password) {
        this.password = password;
    }

    @Override
    public String getType() {
        return "username";
    }

    @Override
    public Descriptor<AuthenticationMethod> getDescriptor() {
        return Jenkins.getInstance().getDescriptorByType(UsernameAuthenticationMethodDescriptor.class);
    }

    @Extension
    public static class UsernameAuthenticationMethodDescriptor extends AuthenticationMethodDescriptor {

        @Override
        public String getDisplayName() {
            return null;
        }

        @Override
        public UsernameAuthenticationMethod newInstance(StaplerRequest sr, JSONObject jo) {
            return new UsernameAuthenticationMethod(jo.getString("user"), Secret.fromString(jo.getString("password")));
        }
    }
}