Allows users to log in. Since 0.9 this module also does server-to-server authentication using certificates.


mod_saslauth implements the standard SASL protocol according to the guidelines in RFC6120.


    modules_enabled = {
        -- Other modules
        "saslauth"; -- Enable mod_saslauth


Option Default Notes
c2s_require_encryption false Whether to force all client-to-server streams are encrypted before allowing authentication
require_encryption false DEPRECATED - Currently used as a fallback value, recommended to use c2s_require_encryption
anonymous_login false DEPRECATED - See Configuring anonymous logins - If set to true, anonymous users will be allowed to login in and authentication disabled. This also disables server-to-server communication
allow_unencrypted_plain_auth false Whether to allow plain-text passwords to be sent over the network
insecure_sasl_mechanisms {"PLAIN", "LOGIN"} Mechanisms that are not allowed on unencrypted connections. Defaults to the empty set if allow_unencrypted_plain_auth is set to true. Introduced in 0.10
disable_sasl_mechanisms {"DIGEST-MD5"} Set of mechanisms that will never be offered. Introduced in 0.10

Cyrus SASL integration

In Prosody 0.7 mod_saslauth also handled Prosody's Cyrus SASL integration. From Prosody 0.8 this support is now in its own authentication module, mod_auth_cyrus. Documentation for all versions has been moved to our Cyrus SASL documentation page.


    modules_enabled = {
        -- Other modules
        "saslauth"; -- Enable mod_saslauth
    c2s_require_encryption = true
    allow_unencrypted_plain_auth = false
    disable_sasl_mechanisms = { "DIGEST-MD5" }
doc/modules/mod_saslauth.txt · Last modified: 2016/07/19 19:05 by Kim Alvefur