else if ("auth".equals(tag)) {// User is trying to authenticate using SASLstartedSASL = true;// Process authentication stanzasaslStatus = SASLAuthentication.handle(session, doc);}

final byte[] challenge = saslServer.evaluateResponse( decoded ); // Either a challenge or success data.

 NameCallback ncb = new NameCallback("PLAIN authentication ID: ",principal);VerifyPasswordCallback vpcb = new VerifyPasswordCallback(password.toCharArray());cbh.handle(new Callback[]{ncb,vpcb});if (vpcb.getVerified()) {vpcb.clearPassword();AuthorizeCallback acb = new AuthorizeCallback(principal,username);cbh.handle(new Callback[]{acb});if(acb.isAuthorized()) {username = acb.getAuthorizedID();completed = true;} else {completed = true;username = null;throw new SaslException("PLAIN: user not authorized: "+principal);}} else {throw new SaslException("PLAIN: user not authorized: "+principal);}

for (Callback callback : callbacks) {if (callback instanceof RealmCallback) {((RealmCallback) callback).setText( XMPPServer.getInstance().getServerInfo().getXMPPDomain() );}else if (callback instanceof NameCallback) {name = ((NameCallback) callback).getName();if (name == null) {name = ((NameCallback) callback).getDefaultName();}//Log.debug("XMPPCallbackHandler: NameCallback: " + name);}else if (callback instanceof PasswordCallback) {try {// Get the password from the UserProvider. Some UserProviders may not support// this operation((PasswordCallback) callback).setPassword(AuthFactory.getPassword(name).toCharArray());//Log.debug("XMPPCallbackHandler: PasswordCallback");}catch (UserNotFoundException | UnsupportedOperationException e) {throw new IOException(e.toString());}}else if (callback instanceof VerifyPasswordCallback) {//Log.debug("XMPPCallbackHandler: VerifyPasswordCallback");VerifyPasswordCallback vpcb = (VerifyPasswordCallback) callback;try {AuthToken at = AuthFactory.authenticate(name, new String(vpcb.getPassword()));vpcb.setVerified((at != null));}catch (Exception e) {vpcb.setVerified(false);}}else if (callback instanceof AuthorizeCallback) {//Log.debug("XMPPCallbackHandler: AuthorizeCallback");AuthorizeCallback authCallback = ((AuthorizeCallback) callback);// Principal that authenticatedString principal = authCallback.getAuthenticationID();// Username requested (not full JID)String username = authCallback.getAuthorizationID();// Remove any REALM from the username. This is optional in the spec and it may cause// a lot of users to fail to log in if their clients is sending an incorrect valueif (username != null && username.contains("@")) {username = username.substring(0, username.lastIndexOf("@"));}if (principal.equals(username)) {//client perhaps made no request, get default usernameusername = AuthorizationManager.map(principal);if (Log.isDebugEnabled()) {//Log.debug("XMPPCallbackHandler: no username requested, using " + username);}}if (AuthorizationManager.authorize(username, principal)) {if (Log.isDebugEnabled()) {//Log.debug("XMPPCallbackHandler: " + principal + " authorized to " + username);}authCallback.setAuthorized(true);authCallback.setAuthorizedID(username);}else {if (Log.isDebugEnabled()) {//Log.debug("XMPPCallbackHandler: " + principal + " not authorized to " + username);}authCallback.setAuthorized(false);}}