@Override
    public String getPassword(String username)
        throws UserNotFoundException, UnsupportedOperationException
    {
        if (!supportsPasswordRetrieval()) {
            throw new UnsupportedOperationException();
        }

        // Check overrides first.
        try {
            return super.getPassword(username);
        } catch (UserNotFoundException e) {
            if (hasOverride(username)) {
                // An override was used. Must not try other providers.
                throw e;
            }
        }

        // When there's no override, try all providers in order.
        for (final AuthProvider provider: getAuthProviders()) {
            try {
                if (provider.supportsPasswordRetrieval()) {
                    return provider.getPassword(username);
                }
            } catch (UserNotFoundException | UnsupportedOperationException e) {
                Log.trace("Could find user {} with auth provider {}. Will try remaining providers (if any)", username, provider.getClass().getName(), e);
            }
        }
        throw new UserNotFoundException();
    }
Returns an auth provider for the provided username, but only if the username is in the 'override' list for that
provider.

When this method returns null, all providers should be attempted. When this method returns a non-null value, then
only the returned provider is to be used for the provided user.

@param username A user identifier (cannot be null or empty).
@return an auth provider that MUST be used for this user.
xmppserver/src/main/java/org/jivesoftware/openfire/auth/HybridAuthProvider.java