public static boolean authorize(String authzid, String authcid) {
        for (AuthorizationPolicy ap : authorizationPolicies) {
            Log.trace("Trying if AuthorizationPolicy {} authorizes {} to act as {}", ap.name(), authcid, authzid);

            if (ap.authorize(authzid, authcid)) {
                // Authorized...  but do you exist?
                try {
                    UserManager.getUserProvider().loadUser(authzid);
                }
                catch (UserNotFoundException nfe) {
                    Log.debug("User {} not found ", authzid, nfe);

                    // Should we add the user?
                    if(JiveGlobals.getBooleanProperty("xmpp.auth.autoadd",false)) {
                        if (UserManager.getUserProvider().isReadOnly()) {
                            return false;
                        }
                        if (UserManager.getUserProvider().isNameRequired() || UserManager.getUserProvider().isEmailRequired()) {
                            // If these are required, there's no way we can arbitrarily auto-create this account.
                            return false;
                        }
                        try {
                            UserManager.getInstance().createUser(authzid, StringUtils.randomString(8), null, null);
                            Log.info("AuthorizationManager: User {} created.", authzid);
                            return true;
                        }
                        catch (UserAlreadyExistsException uaee) {
                            // Somehow the user got created in this very short timeframe.. 
                            // To be safe, lets fail here. The user can always try again.
                            Log.error("AuthorizationManager: User {} already exists while attempting to add user.", authzid, uaee);
                            return false;
                        }
                    }
                    return false;
                }
                // User exists
                return true;
            }
        }
        // Not authorized.
        return false;
    }
Authorize the authenticated username (authcid, principal) to the requested username (authzid).

This uses the selected AuthenticationProviders.

@param authzid authorization identity (identity to act as).
@param authcid authentication identity (identity whose password will be used)
@return true if the user is authorized to act as the requested authorization identity.
xmppserver/src/main/java/org/jivesoftware/openfire/auth/AuthorizationManager.java