private boolean authUserFromRequest(final HttpServletRequest request) {

        final String userFromRequest = servletRequestAuthenticator == null ? null : servletRequestAuthenticator.authenticateRequest(request);
        if (userFromRequest == null) {
            // The user is not authenticated
            return false;
        }

        if (!adminManager.isUserAdmin(userFromRequest, true)) {
            // The user is not authorised
            Log.warn("The user '" + userFromRequest + "' is not an Openfire administrator.");
            return false;
        }

        // We're authenticated and authorised, so record the login,
        loginLimitManager.recordSuccessfulAttempt(userFromRequest, request.getRemoteAddr());

        // Set the auth token
        request.getSession().setAttribute("jive.admin.authToken", AuthToken.generateUserToken( userFromRequest ));

        // And proceed
        return true;
    }
Returns true if a URL passes an exclude rule.

@param url the URL to test.
@param exclude the exclude rule.
@return true if the URL passes the exclude test.
xmppserver/src/main/java/org/jivesoftware/admin/AuthCheckFilter.java