Handles authentication of users and remote servers.


mod_saslauth implements the standard SASL protocol according to the guidelines in RFC6120.


    modules_enabled = {
        -- Other modules
        "saslauth"; -- Enable mod_saslauth


Option Default Notes
c2s_require_encryption false Whether to force all client-to-server streams are encrypted before allowing authentication.
require_encryption false DEPRECATED - Currently used as a fallback value, recommended to use c2s_require_encryption.
anonymous_login false DEPRECATED - See Configuring anonymous logins - If set to true, anonymous users will be allowed to login in and authentication disabled. This also disables server-to-server communication.
allow_unencrypted_plain_auth false Whether to allow plain-text passwords to be used on unencrypted connections.
insecure_sasl_mechanisms {"PLAIN", "LOGIN"} Mechanisms that are not allowed on unencrypted connections. Defaults to the empty set if allow_unencrypted_plain_auth is set to true.
disable_sasl_mechanisms {"DIGEST-MD5"} Set of mechanisms that will never be offered, even on encrypted connections.

Cyrus SASL integration

Documentation for this integration is available on our Cyrus SASL documentation page.


    modules_enabled = {
        -- Other modules
        "saslauth"; -- Enable mod_saslauth
    c2s_require_encryption = true
    allow_unencrypted_plain_auth = false
    disable_sasl_mechanisms = { "DIGEST-MD5" }