private static void authenticationSuccessful(LocalSession session, String username,
            byte[] successData) {
        if (username != null && LockOutManager.getInstance().isAccountDisabled(username)) {
            // Interception!  This person is locked out, fail instead!
            LockOutManager.getInstance().recordFailedLogin(username);
            authenticationFailed(session, Failure.ACCOUNT_DISABLED);
            return;
        }
        sendElement(session, "success", successData);
        // We only support SASL for c2s
        if (session instanceof ClientSession) {
            final AuthToken authToken;
            if (username == null) {
                // AuthzId is null, which indicates that authentication was anonymous.
                authToken = AuthToken.generateAnonymousToken();
            } else {
                authToken = AuthToken.generateUserToken(username);
            }
            ((LocalClientSession) session).setAuthToken(authToken);
        }
        else if (session instanceof IncomingServerSession) {
            String hostname = username;
            // Add the validated domain as a valid domain. The remote server can
            // now send packets from this address
            ((LocalIncomingServerSession) session).addValidatedDomain(hostname);
            ((LocalIncomingServerSession) session).setAuthenticationMethod(ServerSession.AuthenticationMethod.SASL_EXTERNAL);
            Log.info("Inbound Server {} authenticated (via TLS)", username);
        }
    }
Handles the SASL authentication packet. The entity may be sending an initial
authentication request or a response to a challenge made by the server. The returned
value indicates whether the authentication has finished either successfully or not or
if the entity is expected to send a response to a challenge.

@param session the session that is authenticating with the server.
@param doc the stanza sent by the authenticating entity.
@return value that indicates whether the authentication has finished either successfully
        or not or if the entity is expected to send a response to a challenge.
xmppserver/src/main/java/org/jivesoftware/openfire/net/SASLAuthentication.java