--- a/plugins/mod_dialback.lua	Sat Jan 06 08:54:15 2018 +0100
+++ b/plugins/mod_dialback.lua	Sun Feb 04 01:13:27 2018 +0100
@@ -189,6 +189,14 @@
 	end
 end);
 
+module:hook_stanza("urn:ietf:params:xml:ns:xmpp-sasl", "failure", function (origin, stanza)
+	if origin.external_auth == "failed" then
+		module:log("debug", "SASL EXTERNAL failed, falling back to dialback");
+		initiate_dialback(origin);
+		return true;
+	end
+end, 100);
+
 module:hook_stanza(xmlns_stream, "features", function (origin, stanza)
 	if not origin.external_auth or origin.external_auth == "failed" then
 		module:log("debug", "Initiating dialback...");

--- a/plugins/mod_saslauth.lua	Sat Jan 06 08:54:15 2018 +0100
+++ b/plugins/mod_saslauth.lua	Sun Feb 04 01:13:27 2018 +0100
@@ -110,10 +110,12 @@
 	module:log("info", "SASL EXTERNAL with %s failed: %s", session.to_host, condition);
 
 	session.external_auth = "failed"
-	session:close();
-	return true;
 end, 500)
 
+module:hook_stanza(xmlns_sasl, "failure", function (session, stanza)
+	-- TODO: Dialback wasn't loaded.  Do something useful.
+end, 90)
+
 module:hook_tag("http://etherx.jabber.org/streams", "features", function (session, stanza)
 	if session.type ~= "s2sout_unauthed" or not session.secure then return; end