--- a/plugins/mod_dialback.lua	Sat Feb 03 17:36:55 2018 +0100
+++ b/plugins/mod_dialback.lua	Sun Feb 04 01:40:11 2018 +0100
@@ -153,7 +153,7 @@
 				valid = "invalid";
 			end
 			if dialback_verifying.destroyed then
-				log("warn", "Incoming s2s session %s was closed in the meantime, so we can't notify it of the db result",
+				log("warn", "Incoming s2s session %s was closed in the meantime, so we can't notify it of the dialback result",
 					tostring(dialback_verifying):match("%w+$"));
 			else
 				dialback_verifying.sends2s(
@@ -190,6 +190,14 @@
 	end
 end);
 
+module:hook_tag("urn:ietf:params:xml:ns:xmpp-sasl", "failure", function (origin, stanza) -- luacheck: ignore 212/stanza
+	if origin.external_auth == "failed" then
+		module:log("debug", "SASL EXTERNAL failed, falling back to dialback");
+		initiate_dialback(origin);
+		return true;
+	end
+end, 100);
+
 module:hook_tag(xmlns_stream, "features", function (origin, stanza) -- luacheck: ignore 212/stanza
 	if not origin.external_auth or origin.external_auth == "failed" then
 		module:log("debug", "Initiating dialback...");