@Override
    public boolean authorize(String authzid, String authcid) {
        boolean authorized = false;

        String authzUser = authzid;
        String authzRealm = null;
 
        String authcUser = authcid;
        String authcRealm = null;

        if (authzid.contains("@")) {
            authzUser = authzid.substring(0, authzid.lastIndexOf("@"));
            authzRealm = authzid.substring((authzid.lastIndexOf("@")+1));
        }
        if (authcid.contains("@")){
            authcUser = authcid.substring(0,(authcid.lastIndexOf("@")));
            authcRealm = authcid.substring((authcid.lastIndexOf("@")+1));
        }

        if (!SASLAuthentication.PROXY_AUTH.getValue() || !AdminManager.getInstance().isUserAdmin(authcUser, true)) {
            if(!authzUser.equals(authcUser)) {
                // For this policy the user portion of both must match, so lets short circuit here if we can.
                if(IGNORE_CASE.getValue()) {
                    if(!authzUser.equalsIgnoreCase(authcUser)){
                        Log.debug("Authorization username {} doesn't match authentication username {}", authzUser, authcUser);
                        return false;
                    }
                } else {
                    Log.debug("Authorization username {} doesn't match authentication username {}", authzUser, authcUser);
                    return false;
                }
            }
        }
        Log.debug("Checking authcRealm");
        if(authcRealm != null) {
            if(authcRealm.equals(XMPPServerInfo.XMPP_DOMAIN.getValue()))  {
                Log.trace("authcRealm = {}", XMPPServerInfo.XMPP_DOMAIN.getKey());
                authorized = true;
            } else if(authcRealm.equals(SASLAuthentication.REALM.getValue()))  {
                Log.trace("authcRealm = sasl.realm");
                authorized = true;
            } else { 
                for(String realm : SASLAuthentication.APPROVED_REALMS.getValue()) {
                    if(authcRealm.equals(realm)) {
                        Log.trace("authcRealm = {} which is approved", realm);
                        authorized = true;
                    } else {
                        Log.trace("authcRealm != {} which is approved", realm);
                    }
                }
            }
        } else {
            // no realm in the authcRealm
            authorized = true;
        }

        if(!authorized) {
            return false;
        }  else {
            // reset for next round of tests
            authorized = false;
        }
        Log.debug("Checking authzRealm");
        if(authzRealm != null) {
            if(authzRealm.equals(XMPPServerInfo.XMPP_DOMAIN.getValue())) {
                Log.trace("authcRealm = {}", XMPPServerInfo.XMPP_DOMAIN.getKey());
                authorized = true;
            } else {
                if(authcRealm != null && authcRealm.equals(authzRealm)) {
                    Log.trace("DefaultAuthorizationPolicy: authcRealm = {} which is approved", authcRealm);
                    authorized = true;
                }
            }
        } else {
            authorized = true;
        }

        // no more checks
        return authorized;
    }
Returns true if the provided authentication identity (identity whose password will be used) is explicitly allowed
to the provided authorization identity (identity to act as).

@param authzid authorization identity (identity to act as).
@param authcid authentication identity, or 'principal' (identity whose password will be used)
@return true if the authzid is explicitly allowed to be used by the user authenticated with the authcid.
xmppserver/src/main/java/org/jivesoftware/openfire/auth/DefaultAuthorizationPolicy.java