where is devise implementation of "authenticate_user!" method?

It's in lib/devise/controllers/helpers.rb1 and is generated dynamically (user being only one of the possible suffixes):

def self.define_helpers(mapping) #:nodoc:
    mapping = mapping.name

    class_eval <<-METHODS, __FILE__, __LINE__ + 1
      def authenticate_#{mapping}!(opts={})
        opts[:scope] = :#{mapping}
        warden.authenticate!(opts) if !devise_controller? || opts.delete(:force)
      end

      def #{mapping}_signed_in?
        !!current_#{mapping}
      end

      def current_#{mapping}
        @current_#{mapping} ||= warden.authenticate(:scope => :#{mapping})
      end

      def #{mapping}_session
        current_#{mapping} && warden.session(:#{mapping})
      end
    METHODS

    ActiveSupport.on_load(:action_controller) do
      helper_method "current_#{mapping}", "#{mapping}_signed_in?", "#{mapping}_session"
    end
  end

---

When you add devise to rails, you'll typically add in config/routes.rb:

devise_for :user

This is defined in the Devise Mapper class.

which calls Devise.add_mapping for every resource passes to devise_for

the Devise module's add_mapping method is defined here, which subsequently calls define_helpers, which defines authenticate as discussed in other answers.

---

It's declared using some metaprogramming here - https://github.com/plataformatec/devise/blob/master/lib/devise/controllers/helpers.rb#L46-49

class_eval <<-METHODS, __FILE__, __LINE__ + 1
  def authenticate_#{mapping}!(opts={})
    opts[:scope] = :#{mapping}
    warden.authenticate!(opts) if !devise_controller? || opts.delete(:force)
  end
  ...
end

---