Simple Authentication and Security Layer explained

Simple Authentication and Security Layer (SASL) is a framework for authentication and data security in Internet protocols. It decouples authentication mechanisms from application protocols, in theory allowing any authentication mechanism supported by SASL to be used in any application protocol that uses SASL. Authentication mechanisms can also support proxy authorization, a facility allowing one user to assume the identity of another. They can also provide a data security layer offering data integrity and data confidentiality services. DIGEST-MD5 provides an example of mechanisms which can provide a data-security layer. Application protocols that support SASL typically also support Transport Layer Security (TLS) to complement the services offered by SASL.

John Gardiner Myers wrote the original SASL specification (RFC 2222) in 1997. In 2006, that document was replaced by RFC 4422 authored by Alexey Melnikov and Kurt D. Zeilenga. SASL, as defined by RFC 4422 is an IETF Standard Track protocol and is,, a Proposed Standard.

SASL mechanisms

A SASL mechanism implements a series of challenges and responses. Defined SASL mechanisms^[1] include:

SASL-aware application protocols

Application protocols define their representation of SASL exchanges with a profile. A protocol has a service name such as "ldap" in a registry shared with GSSAPI and Kerberos.^[2]

protocols currently supporting SASL include:

• Application Configuration Access Protocol
• Advanced Message Queuing Protocol (AMQP)
• Blocks Extensible Exchange Protocol
• Internet Message Access Protocol (IMAP)
• Internet Message Support Protocol
• Internet Relay Chat (IRC) (with IRCX or the IRCv3 SASL extension)
• Lightweight Directory Access Protocol (LDAP)
• libvirt
• ManageSieve (RFC 5804)
• memcached
• Post Office Protocol (POP)
• Remote framebuffer protocol^[3] used by VNC
• Simple Mail Transfer Protocol (SMTP)
• Subversion protocol
• Extensible Messaging and Presence Protocol (XMPP)

See also

• Transport Layer Security (TLS)

External links

• - Simple Authentication and Security Layer (SASL) - obsoletes
• - Anonymous Simple Authentication and Security Layer (SASL) Mechanism - obsoletes
• - The PLAIN Simple Authentication and Security Layer (SASL) Mechanism - updates
• The IETF SASL Working Group, chartered to revise existing SASL specifications, as well as to develop a family of GSSAPI mechanisms
• Cyrus SASL, a free and portable SASL library providing generic security for various applications
• GNU SASL, a free and portable SASL command-line utility and library, distributed under the GNU GPLv3 and LGPLv2.1, respectively
• Dovecot SASL, an SASL implementation
• (historic) - Using Digest Authentication as a SASL Mechanism, obsoleted in
• Java SASL API Programming and Deployment Guide
• How to fix "No SASL mechanism found" errors when sending email

Notes and References

1. Web site: Simple Authentication and Security Layer (SASL) Mechanisms. iana.org.
2. Web site: Generic Security Service Application Program Interface (GSSAPI)/Kerberos/Simple Authentication and Security Layer (SASL) Service Names. iana.org.
3. Web site: Request for allocation of new security type code for SASL auth. realvnc.com.