Username and Password: How does it work? Suppose a client (Alice) goes to an HTTPS website (Bob) over TLS 1.2.


Alice sends Client Hello with some random number $r_a$.
Bob sends Server Hello with another random number $r_b$.
Suppose they settle on some cipher suite (e.g. RSA, DHE, AES, and SHA1)
Bob sends server certificate
Bob signs and sends server key exchange ($g^b$ in Diffie-Hellman)
(Bob does not request client certificate, and client does not have it.)
Alice sends client key exchange ($g^a$ in Diffie Hellman) (no signing).
Now both share "pre-master secret", namely ($g^{ab}, r_a, r_b$)
Next, for key derivation, they both use pseudorandom function (PRF) to generate from the pre-master secret the following symmetric keys: 


client write key
server write key
client MAC key
server MAC key
client write IV (for use in client AES cipher)
server write IV (for use in server AES cipher)

Alice sends Change Cipher Spec and an encrypted Finished containing MAC of all previous client handshake messages.
Bob sends Change Cipher Spec and an encrypted Finished containing MAC of all previous server handshake messages.
They exchange some encrypted application data.


Suppose now Alice starts signing in with her username and password. What will happen next? Will they just scrap all the previously negotiated keys and switch to TLS-PSK with Password-Authenticated Key Agreement or Password-Based Key Derivation?  Could you please describe how client and server use username and password? What are the steps and algorithms used in this?
"Will they just scrap all the previously negotiated keys and switch to TLS-PSK with

Password-Authenticated Key Agreement or Password-Based Key Derivation?"

No.

"What will happen next?"

"Could you please describe how client and server use username and password?"

"What are the steps and algorithms used in this?"

The server will look up the username's salt, hash the password with it, and then compare

the result to the stored password has. ​ If they are equal, then authentication succeeds,

else authentication fails. ​ The algorithms used in this are PBKDF2,bcrypt,scrypt.