Provide SASL PLAIN mechanism only if TLS is active.
--- a/plugins/mod_saslauth.lua Wed Nov 18 23:25:27 2009 +0100
+++ b/plugins/mod_saslauth.lua Wed Nov 18 23:26:35 2009 +0100
@@ -141,9 +141,11 @@
session.sasl_handler = new_sasl(session.host, anonymous_authentication_profile);
else
session.sasl_handler = new_sasl(session.host, default_authentication_profile);
+ if not session.secure then
+ session.sasl_handler:forbidden({"PLAIN"});
+ end
end
features:tag("mechanisms", mechanisms_attr);
- -- TODO: Provide PLAIN only if TLS is active, this is a SHOULD from the introduction of RFC 4616. This behavior could be overridden via configuration but will issuing a warning or so.
for k, v in pairs(session.sasl_handler:mechanisms()) do
features:tag("mechanism"):text(v):up();
end