private byte[] getSalt(final String username) {
        try {
            String saltshaker = AuthFactory.getSalt(username);
            byte[] salt;
            if (saltshaker == null) {
                Log.debug("No salt found, so resetting password.");
                String password = AuthFactory.getPassword(username);
                AuthFactory.setPassword(username, password);
                salt = DatatypeConverter.parseBase64Binary(AuthFactory.getSalt(username));
            } else {
                salt = DatatypeConverter.parseBase64Binary(saltshaker);
            }
            return salt;
        } catch (UserNotFoundException e) {
            Log.debug("User '{}' not found. Cannot obtain its salt.", username, e);
            // Return a random salt if the user doesn't exist to mimic an invalid password.
            byte[] salt = new byte[24];
            random.nextBytes(salt);
            return salt;
        } catch (UnsupportedOperationException | ConnectionException | InternalUnauthenticatedException e) {
            Log.warn("Exception in SCRAM.getSalt() for user '{}':", username, e);
            byte[] salt = new byte[24];
            random.nextBytes(salt);
            return salt;
        }
    }
Retrieve the salt from the database for a given username.

Returns a random salt if the user doesn't exist to mimic an invalid password.
xmppserver/src/main/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServer.java