How does a framework run custom client code which is implemented against its exposed interface?

I wonder how frameworks or for example JDK APIs run custom client code which is implemented against the interface it provides.

For example javax.security runs the custom code client provided via the implemented methods of the interface. I can't clearly explain myself how the API be able to run implemented class. I think that OK, they expose API via a Java interface, but there must be a runtime or execution mechanism to run that custom code.

import javax.security.auth.spi.LoginModule;

public class CustomerLoginModule implements LoginModule {
   ...
}

package javax.security.auth.spi;

import javax.security.auth.Subject;
import javax.security.auth.AuthPermission;
import javax.security.auth.callback.*;
import javax.security.auth.login.*;
import java.util.Map;

public interface LoginModule {

    void initialize(Subject subject, CallbackHandler callbackHandler,
                    Map<String,?> sharedState,
                    Map<String,?> options);

    boolean login() throws LoginException;

    boolean commit() throws LoginException;

    boolean abort() throws LoginException;

    boolean logout() throws LoginException;
}

How does Java Security API runs client code which is against this interface internally? How does it works under the hood?

Or for example this, again just in the context of interface, I can't explain myself clearly how does this API run custom client code.

package java.util;
public interface EventListener {

}

package com.xxx;
import java.util.EventListener;
public interface IPreferenceObserver extends EventListener {
    void onPreferenceChange();
}