Some general architectural suggestions are available in this FAQ.

Unfortunately, no code examples are available.
However, consider that only the "notifyUser" method of the Metadata Adapter is involved in authentication. The other "notify" methods are related to authorization of specific actions (namely, opening of new sessions and subscriptions to items). For instance, by implementing "notifyNewSession" and "notifySessionClose", you can keep track of the number of sessions currently open for each user and block new sessions if some user related limit is reached.

Note that the "notifyUser" implementation can be blocking, but it should also collect any user authorization information available and cache it, so that the other authorization methods can be nonblocking.