@Override
  public byte[] evaluateResponse(byte[] response) throws SaslException {
    try {
      // parse the response
      // message   = [authzid] UTF8NUL authcid UTF8NUL passwd'

      Deque<String> tokenList = new ArrayDeque<String>();
      StringBuilder messageToken = new StringBuilder();
      for (byte b : response) {
        if (b == 0) {
          tokenList.addLast(messageToken.toString());
          messageToken = new StringBuilder();
        } else {
          messageToken.append((char) b);
        }
      }
      tokenList.addLast(messageToken.toString());

      // validate response
      if (tokenList.size() < 2 || tokenList.size() > 3) {
        throw new SaslException("Invalid message format");
      }
      String passwd = tokenList.removeLast();
      user = tokenList.removeLast();
      // optional authzid
      String authzId;
      if (tokenList.isEmpty()) {
        authzId = user;
      } else {
        authzId = tokenList.removeLast();
      }
      if (user == null || user.isEmpty()) {
        throw new SaslException("No user name provided");
      }
      if (passwd == null || passwd.isEmpty()) {
        throw new SaslException("No password name provided");
      }

      NameCallback nameCallback = new NameCallback("User");
      nameCallback.setName(user);
      PasswordCallback pcCallback = new PasswordCallback("Password", false);
      pcCallback.setPassword(passwd.toCharArray());
      AuthorizeCallback acCallback = new AuthorizeCallback(user, authzId);

      Callback[] cbList = {nameCallback, pcCallback, acCallback};
      handler.handle(cbList);
      if (!acCallback.isAuthorized()) {
        throw new SaslException("Authentication failed");
      }
    } catch (IllegalStateException eL) {
      throw new SaslException("Invalid message format", eL);
    } catch (IOException eI) {
      throw new SaslException("Error validating the login", eI);
    } catch (UnsupportedCallbackException eU) {
      throw new SaslException("Error validating the login", eU);
    }
    return null;
  }
Sun JDK only provides a PLAIN client and no server. This class implements the Plain SASL server
conforming to RFC #4616 (http://www.ietf.org/rfc/rfc4616.txt).
standalone-metastore/metastore-common/src/main/java/org/apache/hadoop/hive/metastore/MetaStorePlainSaslServer.java