---
name: "auth_sasl"
section: "3"
platform: "linux"
package: "courier-authlib-dev"
version: "0.72.4-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/auth_sasl"
---

# auth\_sasl(3)

SASL implementation

## NAME

auth\_sasl, auth\_sasl\_ex - SASL implementation

## SYNOPSIS

```
#include <courierauthsasl.h>
```

**int rc=auth\_sasl(const char \****method***, const char \****initialresponse***, char \****(\*conversation\_func)***(const char \*, void \*)), void \****callback\_arg***, char \*\****authtype\_ret***, char \*\****authdata\_ret***);**

**int rc=auth\_sasl\_ex(const char \****method***, const char \****initialresponse***, const char \****externalauth***, char \****(\*conversation\_func)***(const char \*, void \*)), void \****callback\_arg***, char \*\****authtype\_ret***, char \*\****authdata\_ret***);**

## DESCRIPTION

**auth\_sasl** is a generic SASL server implementation. *method* is the requested SASL method. At this time **auth\_sasl** knows how to handle the following SASL methods:

• LOGIN

• PLAIN

• CRAM-MD5

• CRAM-SHA1

*initialresponse* is a base64-encoded initial response provided in the client's SASL request. *initialresponse* must be NULL if an initial response was not included in the client's SASL request.

*conversation\_func* is the application-implemented SASL conversation callback function. *conversation\_func* receives a base64-encoded SASL prompt, and the *callback\_arg* argument to **auth\_sasl**. *conversation\_func* must return a buffer containing the base64-encoded reply from the client. **auth\_sasl** will [**free**(3)](/free/3.md) this buffer when it's done. *conversation\_func* should return NULL to abort the SASL conversation.

**auth\_sasl\_ex** is a version of **auth\_sasl** that recognizes the EXTERNAL SASL method. It takes an extra parameter, *externalauth*. This parameter should be set to indicate an login that was authenticated via some other means, such as, perhaps, an SSL certificate, or NULL if no externally-authenticated identity was established.

If *method* is not EXTERNAL, **auth\_sasl\_ex** is identical to **auth\_sasl**, and *externalauth* is ignored. Otherwise, if *method* is EXTERNAL and *externalauth* is not NULL, **auth\_sasl\_ex** returns AUTHSASL\_OK, and sets *\*authtype\_ret* and *\*authdata\_ret* accordingly, so that the subsequent invocation of **auth\_generic**() returns authentication information for the login ID specified by *externalauth*.

## RETURNS

If the SASL conversation succesfully completes, **auth\_sasl** or **auth\_sasl\_ex** initializes *\*authtype\_ret* and *\*authdata\_ret*. They will be set to a [**malloc**(3)](/malloc/3.md)-ed buffers that can be directly passed as arguments to [**auth\_generic\_meta**(3)](/auth_generic_meta/3.md)\[1\]. It is the application's responsibility to [**free**(3)](/free/3.md) these buffers when it's done with them.

**auth\_sasl** or **auth\_sasl\_ex** returns AUTHSASL\_OK when the SASL conversation succesfully completes, and *\*authtype\_ret* and *\*authdata\_ret* are succesfully assembled. Any other return indicates an error condition. Right now two error conditions are defined:

AUTHSASL\_ABORTED

The SASL conversation was aborted by the client.

AUTHSASL\_ERROR

General error (insufficient memory, or some other reason). Check *errno* for any clues.

## SEE ALSO

[**authlib**(3)](/authlib/3.md)\[2\], [**auth\_generic\_meta**(3)](/auth_generic_meta/3.md)\[1\].

## NOTES

- 1\.

  [**auth\_generic\_meta**(3)](/auth_generic_meta/3.md)

  http://www.courier-mta.org/authlib/auth\_generic.html

- 2\.

  [**authlib**(3)](/authlib/3.md)

  http://www.courier-mta.org/authlib/authlib.html