protected boolean authenticateClient(Element doc) throws DocumentException, IOException,
            XmlPullParserException {
        // Ensure that connection was encrypted if TLS was required
        if (socketReader.connection.getConfiguration().getTlsPolicy() == Connection.TLSPolicy.required &&
                !socketReader.connection.isEncrypted()) {
            socketReader.closeNeverEncryptedConnection();
            return false;
        }

        boolean isComplete = false;
        boolean success = false;
        while (!isComplete) {
            SASLAuthentication.Status status = SASLAuthentication.handle(socketReader.session, doc);
            if (status == SASLAuthentication.Status.needResponse) {
                // Get the next answer since we are not done yet
                doc = socketReader.reader.parseDocument().getRootElement();
                if (doc == null) {
                    // Nothing was read because the connection was closed or dropped
                    isComplete = true;
                }
            }
            else {
                isComplete = true;
                success = status == SASLAuthentication.Status.authenticated;
            }
        }
        return success;
    }
TLS negotiation was successful so open a new stream and offer the new stream features.
The new stream features will include available SASL mechanisms and specific features
depending on the session type such as auth for Non-SASL authentication and register
for in-band registration.
xmppserver/src/main/java/org/jivesoftware/openfire/net/SocketReadingMode.java