I'm developing an application in which activiti plays a crucial part (it is like activiti-explorer with customizations). Obviously I wanted to delegate as much as I could to activiti, but the identity service was a no-go because it saves passwords of users as plain text. I decided to make a small addition to activiti and figured that other developers maybe had the same problems, so I made it publicly available on GitHub. The plugin saves passwords as a hash with salt and doesn't require any other changes in the application. Logging in and changing passwords work.
All instalation details are described on GitHub. One thing that I should say is, that the code is written in Java 8 (using streams), but if someone has the need I could modify it to Java 7 as well.
Since most of the classes which the plugin uses didn't change since version 5.16.3, I would expect it to work on 5.18 without problems. The installation instructions are provided in the Readme on Github. You just have to make sure, that you are using Java 8, since the plugin uses streams. If you want to make it work on a lower version of Java, feel free to fork the source and modify the streams into for loops - it shouldn't be so hard, there are only 6 classes.