adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-11-03 10:52:22 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

SASL Login to ZNC #198

New Issue
Closed
opened 2026-10-05 04:03:47 +02:00 by adam · 22 comments
adam commented 2026-10-05 04:03:47 +02:00
Owner
Copy link
Copy source

It would be nice to see users able to log into their ZNC account via SASL.

--- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/101799-sasl-login-to-znc?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github).
It would be nice to see users able to log into their ZNC account via SASL. ## <bountysource-plugin> --- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/101799-sasl-login-to-znc?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin> <!-- github-sync-id:10682126 -->
adam closed this issue 2026-10-05 04:03:47 +02:00
adam commented 2026-10-05 04:03:48 +02:00
Author
Owner
Copy link
Copy source

Does this mean SASL to ZNC or Cyrus? I think this means SASL to IRC as in PLAIN/EXTERNAL/ecdsa-nist256p-challenge but after talking on #znc at freenode, I am not sure.

Does this mean SASL to ZNC or Cyrus? I think this means SASL to IRC as in PLAIN/EXTERNAL/ecdsa-nist256p-challenge but after talking on #znc at freenode, I am not sure. <!-- github-comment-id:70364827 -->
adam commented 2026-10-05 04:03:48 +02:00
Author
Owner
Copy link
Copy source

@Mikaela there is already a cyrusauth module which checks password against saslauthd.
So this issue must be about https://github.com/ircv3/ircv3-specifications/blob/master/extensions/sasl-3.1 (I think)

@Mikaela there is already a cyrusauth module which checks password against saslauthd. So this issue must be about https://github.com/ircv3/ircv3-specifications/blob/master/extensions/sasl-3.1 (I think) <!-- github-comment-id:70365246 -->
adam commented 2026-10-05 04:03:49 +02:00
Author
Owner
Copy link
Copy source

Ok, so IAL. There is also https://github.com/ircv3/ircv3-specifications/blob/master/extensions/sasl-3.2.md which should probably also be supported.

Ok, so IAL. There is also https://github.com/ircv3/ircv3-specifications/blob/master/extensions/sasl-3.2.md which should probably also be supported. <!-- github-comment-id:70365353 -->
adam commented 2026-10-05 04:03:50 +02:00
Author
Owner
Copy link
Copy source

Yes this is about cap sasl.

Yes this is about cap sasl. <!-- github-comment-id:70390190 -->
adam commented 2026-10-05 04:03:50 +02:00
Author
Owner
Copy link
Copy source

Has anything happened with this? I guess at first the supported mechanisms should be PLAIN and EXTERNAL (when *certauth is loaded).

Would this work the same way as now, SASL username Mikaela@jolla/freenode and SASL password as password?

Has anything happened with this? I guess at first the supported mechanisms should be PLAIN and EXTERNAL (when *certauth is loaded). Would this work the same way as now, SASL username `Mikaela@jolla/freenode` and SASL password as password? <!-- github-comment-id:76158935 -->
adam commented 2026-10-05 04:03:51 +02:00
Author
Owner
Copy link
Copy source

Even with sasl, clients still send USER, so probably sasl username can be
without network and client embedded

2015-02-26 2:56 GMT-08:00 Mikaela Suomalainen notifications@github.com:

Has anything happened with this? I guess at first the supported mechanisms
should be PLAIN and EXTERNAL (when *certauth is loaded).

Would this work the same way as now, SASL username Mikaela@jolla/freenode
and SASL password as password?

—
Reply to this email directly or view it on GitHub
https://github.com/znc/znc/issues/296#issuecomment-76158935.

Even with sasl, clients still send USER, so probably sasl username can be without network and client embedded 2015-02-26 2:56 GMT-08:00 Mikaela Suomalainen notifications@github.com: > Has anything happened with this? I guess at first the supported mechanisms > should be PLAIN and EXTERNAL (when *certauth is loaded). > > Would this work the same way as now, SASL username Mikaela@jolla/freenode > and SASL password as password? > > — > Reply to this email directly or view it on GitHub > https://github.com/znc/znc/issues/296#issuecomment-76158935. <!-- github-comment-id:76196690 -->
adam commented 2026-10-05 04:03:51 +02:00
Author
Owner
Copy link
Copy source

Even with sasl, clients still send USER, so probably sasl username can be without network and client embedded

There are cases where the user cannot control USER though, like webchat (someone on IRC wanted to use KiwiIRC with znc)

> Even with sasl, clients still send USER, so probably sasl username can be without network and client embedded There are cases where the user cannot control USER though, like webchat (someone on IRC wanted to use KiwiIRC with znc) <!-- github-comment-id:78857062 -->
adam commented 2026-10-05 04:03:52 +02:00
Author
Owner
Copy link
Copy source

10:03 (Mikaela) grawity: I am not sure what your latest comment means as KiwiIRC works with ZNC withut issues. Just check "I have a password" and write your Mikaela@kiwi/freenode:swordfish

Disregard the last comment then... [aFreshMelon in #znc was very insistent that kiwi requires SASL support, though.]

> 10:03 (Mikaela) grawity: I am not sure what your latest comment means as KiwiIRC works with ZNC withut issues. Just check "I have a password" and write your Mikaela@kiwi/freenode:swordfish Disregard the last comment then... [aFreshMelon in #znc was very insistent that kiwi requires SASL support, though.] <!-- github-comment-id:78859102 -->
adam commented 2026-10-05 04:03:53 +02:00
Author
Owner
Copy link
Copy source

Maybe how Kiwi works should be opened a little, to user it works like this:

Maybe how Kiwi works should be opened a little, to user it works like this: - Nick is used as SASL Username (https://github.com/prawnsalad/KiwiIRC/issues/674) and password is used as SASL password. - If SASL fails, KiwiIRC sends the given password normally with PASS. <!-- github-comment-id:78860079 -->
adam commented 2026-10-05 04:03:53 +02:00
Author
Owner
Copy link
Copy source

One issue related to ZNC not supporting SASL for logging in is that clients often default to using SASL instead of PASS and it's difficult for some users to understand that they should be using some random option instead of it. This has happened on #znc recently.

I think SASL is nowadays more widely understood by people than server password.

One issue related to ZNC not supporting SASL for logging in is that clients often default to using SASL instead of PASS and it's difficult for some users to understand that they should be using some random option instead of it. This has happened on #znc recently. I think SASL is nowadays more widely understood by people than server password. <!-- github-comment-id:187834773 -->
adam commented 2026-10-05 04:03:54 +02:00
Author
Owner
Copy link
Copy source

I have implemented SASL PLAIN in ZNC 1.6.3. It still needs some work and testing, but I can make a PR if there is any interest when it is ready.

SASL Debug Output

I have implemented SASL PLAIN in ZNC 1.6.3. It still needs some work and testing, but I can make a PR if there is any interest when it is ready. [SASL Debug Output](https://gist.github.com/MrLenin/bcc550abcb1a0cc67f9a87b5959b0f96) <!-- github-comment-id:264624367 -->
adam commented 2026-10-05 04:03:55 +02:00
Author
Owner
Copy link
Copy source

Yay!
But it should go to master branch, not to 1.6

Yay! But it should go to master branch, not to 1.6 <!-- github-comment-id:264626020 -->
adam commented 2026-10-05 04:03:55 +02:00
Author
Owner
Copy link
Copy source

I figured as much, but I needed to do it on 1.6.3 for our own purposes first. I will be moving the changes over to a master-based branch after.

I figured as much, but I needed to do it on 1.6.3 for our own purposes first. I will be moving the changes over to a master-based branch after. <!-- github-comment-id:264662695 -->
adam commented 2026-10-05 04:03:56 +02:00
Author
Owner
Copy link
Copy source

I have completed moving my changes so far to a master-based branch.
It can be viewed here
I will hold off on making a PR until I implement handling of numeric 905/ERR_SASLTOOLONG (possibly later tonight), but if anyone would care to look it over and comment, I'd appreciate it.
I committed my .gitignore changes separately as I doubt you guys are too interested in adding VS specific stuff to it (my development environment for this has been VS with the Linux Development addon and Bash/Ubuntu for Windows)

I have completed moving my changes so far to a master-based branch. [It can be viewed here](https://github.com/MrLenin/znc/commits/sasl-plain) I will hold off on making a PR until I implement handling of numeric 905/ERR_SASLTOOLONG (possibly later tonight), but if anyone would care to look it over and comment, I'd appreciate it. I committed my .gitignore changes separately as I doubt you guys are too interested in adding VS specific stuff to it (my development environment for this has been VS with the Linux Development addon and Bash/Ubuntu for Windows) <!-- github-comment-id:264674359 -->
adam commented 2026-10-05 04:03:57 +02:00
Author
Owner
Copy link
Copy source

@MrLenin, what status of PR-readiness? :)

@MrLenin, what status of PR-readiness? :) <!-- github-comment-id:296854112 -->
adam commented 2026-10-05 04:03:57 +02:00
Author
Owner
Copy link
Copy source

Ready as it has been since the last commit. Really was just looking for some more in depth review before making a PR as I touch znc-core a bit

Ready as it has been since the last commit. Really was just looking for some more in depth review before making a PR as I touch znc-core a bit <!-- github-comment-id:304483716 -->
adam commented 2026-10-05 04:03:58 +02:00
Author
Owner
Copy link
Copy source

Worked "properly" with my minimal testing wrt hexchat, almost no testing with other clients

Worked "properly" with my minimal testing wrt hexchat, almost no testing with other clients <!-- github-comment-id:304484284 -->
adam commented 2026-10-05 04:03:59 +02:00
Author
Owner
Copy link
Copy source

My code is as free as can be, if the znc devs what to hack it into znc in a way that fits their their goals and agenda, they are more than welcome to. My code is written with a bias towards the network we use it on. unfortunately. the only reason I keep my stuff separate.

My code is as free as can be, if the znc devs what to hack it into znc in a way that fits their their goals and agenda, they are more than welcome to. My code is written with a bias towards the network we use it on. unfortunately. the only reason I keep my stuff separate. <!-- github-comment-id:304485190 -->
adam commented 2026-10-05 04:03:59 +02:00
Author
Owner
Copy link
Copy source

@MrLenin You didn't open the PR as promised, so I thought you had abandoned this.
So there was a miscommunication :(

There should be an integration test for it.

@MrLenin You didn't open the PR as promised, so I thought you had abandoned this. So there was a miscommunication :( There should be an integration test for it. <!-- github-comment-id:305636900 -->
adam commented 2026-10-05 04:04:00 +02:00
Author
Owner
Copy link
Copy source

I was unable to get cyrusauth working using saslauthd. The saslauthd needs to be integrated into ZNC.

The current default auth method is absolutely ridiculous and the use of the user string should not extend beyond their username. The servers/etc are all a completely abstracted idea to the concept of the ZNC. I shouldn't have to configure 5 networks just to change the user string to /network for each and having them identical otherwise.

I was unable to get cyrusauth working using saslauthd. The saslauthd needs to be integrated into ZNC. The current default auth method is absolutely ridiculous and the use of the user string should not extend beyond their username. The servers/etc are all a completely abstracted idea to the concept of the ZNC. I shouldn't have to configure 5 networks just to change the user string to /network for each and having them identical otherwise. <!-- github-comment-id:529367039 -->
adam commented 2026-10-05 04:04:01 +02:00
Author
Owner
Copy link
Copy source

I was unable to get cyrusauth working

That's because cyrusauth module has nothing to do with SASL login.

The current default auth method is absolutely ridiculous

Yes, it is, but SASL wouldn't improve it. No existing SASL mechanism has a concept of IRC networks and clients.

I shouldn't have to configure 5 networks

This sounds like you want some kind of multiplexing of connections, which also has nothing to do with SASL.

You may want to take a look at https://github.com/ircv3/ircv3-ideas/issues/39

> I was unable to get cyrusauth working That's because cyrusauth module has nothing to do with SASL login. > The current default auth method is absolutely ridiculous Yes, it is, but SASL wouldn't improve it. No existing SASL mechanism has a concept of IRC networks and clients. > I shouldn't have to configure 5 networks This sounds like you want some kind of multiplexing of connections, which also has nothing to do with SASL. You may want to take a look at https://github.com/ircv3/ircv3-ideas/issues/39 <!-- github-comment-id:529379206 -->
adam commented 2026-10-05 04:04:01 +02:00
Author
Owner
Copy link
Copy source

PR open at: https://github.com/znc/znc/pull/1573

PR open at: https://github.com/znc/znc/pull/1573 <!-- github-comment-id:1699389600 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#198