diff --git a/grub-core/lib/legacy_parse.c b/grub-core/lib/legacy_parse.c
index 3f28544b3..868eab4ab 100644
--- a/grub-core/lib/legacy_parse.c
+++ b/grub-core/lib/legacy_parse.c
@@ -146,7 +146,8 @@ struct legacy_command legacy_commands[] =
      " \"netbsd\", \"freebsd\", \"openbsd\", \"linux\", \"biglinux\" and"
      " \"multiboot\". The option --no-mem-option tells GRUB not to pass a"
      " Linux's mem option automatically."},
-    /* FIXME: lock is unsupported. */
+    {"lock", "if ! authenticate legacy; then return; fi", NULL, 0, 0, {}, 0,
+     0, "Break a command execution unless the user is authenticated."},
     {"makeactive", "parttool \"$root\" boot+\n", NULL, 0, 0, {}, 0, 0,
      "Set the active partition on the root disk to GRUB's root device."
      " This command is limited to _primary_ PC partitions on a hard disk."},
@@ -435,12 +436,6 @@ grub_legacy_parse (const char *buf, char **entryname, char **suffix)
       return NULL;
     }
 
-  if (grub_strncmp ("lock", cmdname, ptr - cmdname) == 0
-      && ptr - cmdname == sizeof ("lock") - 1)
-    {
-      /* FIXME */
-    }
-
   for (cmdnum = 0; cmdnum < ARRAY_SIZE (legacy_commands); cmdnum++)
     if (grub_strncmp (legacy_commands[cmdnum].name, cmdname, ptr - cmdname) == 0
 	&& legacy_commands[cmdnum].name[ptr - cmdname] == 0)
diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c
index bf1efbfdd..e5216da8c 100644
--- a/grub-core/normal/auth.c
+++ b/grub-core/normal/auth.c
@@ -248,3 +248,27 @@ grub_auth_check_authentication (const char *userlist)
 
   return GRUB_ACCESS_DENIED;
 }
+
+static grub_err_t
+grub_cmd_authenticate (struct grub_command *cmd __attribute__ ((unused)),
+		       int argc, char **args)
+{
+  return grub_auth_check_authentication ((argc >= 1) ? args[0] : "");
+}
+
+static grub_command_t cmd;
+
+void
+grub_normal_auth_init (void)
+{
+  cmd = grub_register_command ("authenticate",
+			       grub_cmd_authenticate,
+			       N_("[USERLIST]"), N_("Authenticate users"));
+
+}
+
+void
+grub_normal_auth_fini (void)
+{
+  grub_unregister_command (cmd);
+}
diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
index c7e83fba0..f2e5eaf51 100644
--- a/grub-core/normal/main.c
+++ b/grub-core/normal/main.c
@@ -477,6 +477,7 @@ GRUB_MOD_INIT(normal)
   /* Previously many modules depended on gzio. Be nice to user and load it.  */
   grub_dl_load ("gzio");
 
+  grub_normal_auth_init ();
   grub_context_init ();
   grub_script_init ();
   grub_menu_init ();
@@ -520,6 +521,7 @@ GRUB_MOD_FINI(normal)
   grub_context_fini ();
   grub_script_fini ();
   grub_menu_fini ();
+  grub_normal_auth_fini ();
 
   grub_xputs = grub_xputs_saved;
 
diff --git a/include/grub/normal.h b/include/grub/normal.h
index 417560d9f..72912e524 100644
--- a/include/grub/normal.h
+++ b/include/grub/normal.h
@@ -123,4 +123,7 @@ grub_normal_add_menu_entry (int argc, const char **args, char **classes,
 grub_err_t
 grub_normal_set_password (const char *user, const char *password);
 
+void grub_normal_auth_init (void);
+void grub_normal_auth_fini (void);
+
 #endif /* ! GRUB_NORMAL_HEADER */