Solution: 1
The function wp_authenticate($username, $password) is a WP function so there is no need to add it in functions.php. It can be found in pluggable.php in the wp-includes directory.
And yes, you have to call it in your form or the validation script, in the same way you call any other function. For example:
$CheckValidUser = wp_authenticate($username, $password);
I would guess you should call it before calling is_user_logged_in(), otherwise there won’t be any $username or $password as WP has already rejected the user.
Hope this helps.