@Override
    public void authenticate(String username, String password) throws UnauthorizedException, ConnectionException, InternalUnauthenticatedException {
        // Check overrides first.
        try {
            super.authenticate(username, password);
            return;
        } catch (UnauthorizedException e) {
            if (hasOverride(username)) {
                // An override was used. Must not try other providers.
                throw e;
            }
        }

        // When there's no override, try all providers in order.
        for (final AuthProvider provider: getAuthProviders()) {
            try {
                provider.authenticate(username, password);
                return;
            } catch (UnauthorizedException e) {
                Log.trace("Could not authenticate user {} with auth provider {}. Will try remaining providers (if any)", username, provider.getClass().getName(), e);
            }
        }
        throw new UnauthorizedException();
    }
Returns an auth provider for the provided username, but only if the username is in the 'override' list for that
provider.

When this method returns null, all providers should be attempted. When this method returns a non-null value, then
only the returned provider is to be used for the provided user.

@param username A user identifier (cannot be null or empty).
@return an auth provider that MUST be used for this user.
xmppserver/src/main/java/org/jivesoftware/openfire/auth/HybridAuthProvider.java