public static Element getSASLMechanismsElement( ClientSession session )
    {
        final Element result = DocumentHelper.createElement( new QName( "mechanisms", new Namespace( "", SASL_NAMESPACE ) ) );
        for (String mech : getSupportedMechanisms()) {
            if (mech.equals("EXTERNAL")) {
                boolean trustedCert = false;
                if (session.isEncrypted()) {
                    final Connection connection = ( (LocalClientSession) session ).getConnection();
                    assert connection != null; // While the client is performing a SASL negotiation, the connection can't be null.
                    if ( SKIP_PEER_CERT_REVALIDATION_CLIENT.getValue() ) {
                        // Trust that the peer certificate has been validated when TLS got established.
                        trustedCert = connection.getPeerCertificates() != null && connection.getPeerCertificates().length > 0;
                    } else {
                        // Re-evaluate the validity of the peer certificate.
                        final TrustStore trustStore = connection.getConfiguration().getTrustStore();
                        trustedCert = trustStore.isTrusted( connection.getPeerCertificates() );
                    }
                }
                if ( !trustedCert ) {
                    continue; // Do not offer EXTERNAL.
                }
            }
            final Element mechanism = result.addElement("mechanism");
            mechanism.setText(mech);
        }

        // OF-2072: Return null instead of an empty element, if so configured.
        if ( JiveGlobals.getBooleanProperty("sasl.client.suppressEmpty", false) && result.elements().isEmpty() ) {
            return null;
        }

        return result;
    }
Returns an XML element with the valid SASL mechanisms available for the specified session. If
the session's connection is not secured then only include the SASL mechanisms that don't
require TLS.

@param session The current session

@return The valid SASL mechanisms available for the specified session.
xmppserver/src/main/java/org/jivesoftware/openfire/net/SASLAuthentication.java