Looks like exmpp problem, not ejabberd, but it seems I cannot create tickets for exmpp project?
Function fields/2 in exmpp/src/server/exmpp_server_legacy_auth.erl (r863) tries to get username from auth iq using the code
However, <username> is located several levels down in Request_IQ, and get_element is not recursive - so this code isn't likely to ever succeed.
Therefore <auth> answer from ejabberd always contains empty <username> element regardless of what client sent in request.
Changing exmpp_xml:get_element use to self-written recursive version fixes this.