@Override
    public void readExternal( ObjectInput in ) throws IOException, ClassNotFoundException
    {
        super.readExternal( in );

        final ExternalizableUtil util = ExternalizableUtil.getInstance();
        util.readSerializableMap( in, nodes, getClass().getClassLoader() );
        associationPolicy = LeafNodeAssociationPolicy.valueOf( util.readSafeUTF( in ) );
        util.readSerializableCollection( in, associationTrusted, getClass().getClassLoader() );
        maxLeafNodes = util.readInt( in );
        Log = LoggerFactory.getLogger(getClass().getName() + "[" + super.serviceIdentifier + "#" + super.getNodeID() +"]");
    }
Only those on a whitelist may associate leaf nodes with the collection.
xmppserver/src/main/java/org/jivesoftware/openfire/pubsub/CollectionNode.java