@Override
    public void authenticate(String username, String password) throws UnauthorizedException {
        if (username == null || password == null) {
            throw new UnauthorizedException();
        }
        if (username.contains("@")) {
            // Check that the specified domain matches the server's domain
            int index = username.indexOf("@");
            String domain = username.substring(index + 1);
            if (domain.equals(XMPPServer.getInstance().getServerInfo().getXMPPDomain())) {
                username = username.substring(0, index);
            } else {
                // Unknown domain. Return authentication failed.
                throw new UnauthorizedException();
            }
        }
        String userPassword;
        try {
            userPassword = getPasswordValue(username);
        }
        catch (UserNotFoundException unfe) {
            throw new UnauthorizedException();
        }
        
        if (comparePasswords(password, userPassword)) {
            // Got this far, so the user must be authorized.
            createUser(username);
        } else {
            throw new UnauthorizedException();
        }
    }
XMPP disallows some characters in identifiers, requiring them to be escaped.

This implementation assumes that the database returns properly escaped identifiers,
but can apply escaping by setting the value of the 'jdbcAuthProvider.isEscaped'
property to 'false'.

@return 'false' if this implementation needs to escape database content before processing.
xmppserver/src/main/java/org/jivesoftware/openfire/auth/JDBCAuthProvider.java