I just got a report [1] that the patch is incomplete, because authzid is used to calculate A1 value of the response (RFC2831 2.1.2.1). Stay tuned for an updated version. 1: https://github.com/Flowdalic/asmack/commit/2b4d004fe5a7b4224380a32658ff20560c6c3a05#commitcomment-5636515