sasl: show which mechanism succeeds #426

New Issue

2026-10-05T04:20:10+02:00

adam commented

2026-10-05 04:20:10 +02:00

Currently *sasl only tells failing mechanisms, but if I have multiple mechanisms, I only see the failing ones.

Examples on how I think it should work:

Some modern network with mechanisms EXTERNAL ECDSA-NIST256P-CHALLENGE PLAIN :

EXTERNAL succeeded.
mechanisms that weren't attempted: ECDSA-NIST256P-CHALLENGE PLAIN

maybe freenode:

EXTERNAL failed.
ECDSA-NIST256P-CHALLENGE succeeded.
mechanisms that weren't attempted: PLAIN

and some third older network could say:

EXTERNAL failed.
ECDSA-NIST256P-CHALLENGE failed.

* and as this network had only PLAIN left and it succeeded, it doesn't need any mention.

If I had configured only PLAIN on all networks and it succeeded there, no notice would be given which is the same as with current behaviour.

I acted that https://github.com/znc/znc/issues/746 was already done so the list could be more often used.

Currently *sasl only tells failing mechanisms, but if I have multiple mechanisms, I only see the failing ones. Examples on how I think it should work: - Some modern network with mechanisms EXTERNAL ECDSA-NIST256P-CHALLENGE PLAIN : > EXTERNAL succeeded. > mechanisms that weren't attempted: ECDSA-NIST256P-CHALLENGE PLAIN - maybe freenode: > EXTERNAL failed. > ECDSA-NIST256P-CHALLENGE succeeded. > mechanisms that weren't attempted: PLAIN - and some third older network could say: > EXTERNAL failed. > ECDSA-NIST256P-CHALLENGE failed. ``` * and as this network had only PLAIN left and it succeeded, it doesn't need any mention. ``` If I had configured only PLAIN on all networks and it succeeded there, no notice would be given which is the same as with current behaviour. --- _I acted that https://github.com/znc/znc/issues/746 was already done so the list could be more often used._

adam closed this issue

2026-10-05 04:20:10 +02:00

adam commented

2026-10-05 04:20:11 +02:00

In case this is going to be asked again, I am adding the questions from IRC here:

[22:16:27] <KindOne> Mikaela, so... if I auth with PLAIN, everytime znc connects to freenode and is successful, I get a message?
[22:16:48] <Mikaela> KindOne: if your only configured SASL mechanism is PLAIN you get no notice
[22:17:18] <Mikaela> but if you have more than one message and the first or middle one succeeds, you get message telling you which of them succeeded

[23:51:26] <teward> Mikaela: we get notifications of which actually fail, are you just adding a 'Succeeded' note?
[08:32:01] <Mikaela> teward: if you have more than one SASL mechanisms and the last one succeeds there would be no notice. If you have three or more mechanisms, you are told if other than the last mechanism succeeds. Isn't this clear on that issue examples?

In case this is going to be asked again, I am adding the questions from IRC here: ``` [22:16:27] <KindOne> Mikaela, so... if I auth with PLAIN, everytime znc connects to freenode and is successful, I get a message? [22:16:48] <Mikaela> KindOne: if your only configured SASL mechanism is PLAIN you get no notice [22:17:18] <Mikaela> but if you have more than one message and the first or middle one succeeds, you get message telling you which of them succeeded ``` ``` [23:51:26] <teward> Mikaela: we get notifications of which actually fail, are you just adding a 'Succeeded' note? [08:32:01] <Mikaela> teward: if you have more than one SASL mechanisms and the last one succeeds there would be no notice. If you have three or more mechanisms, you are told if other than the last mechanism succeeds. Isn't this clear on that issue examples? ```

adam commented

2026-10-05 04:20:11 +02:00

2014-12-14 13:12:56+0200 < kerio> Mikaela: about issue #770, shouldn't we get a message if the *first* doesn't succeed?
2014-12-14 13:14:19+0200 < Mikaela> kerio: if you use three mechanisms from which first two don't take password and the third takes, you want to know if first or second succeeds so you can disable the third which wants password

``` 2014-12-14 13:12:56+0200 < kerio> Mikaela: about issue #770, shouldn't we get a message if the *first* doesn't succeed? 2014-12-14 13:14:19+0200 < Mikaela> kerio: if you use three mechanisms from which first two don't take password and the third takes, you want to know if first or second succeeds so you can disable the third which wants password ```

adam commented

2026-10-05 04:20:12 +02:00

I like this proposal, though perhaps with an option. Something like:

/msg *sasl verbose on

or even...

/msg *sasl notify_failed on

The name of the option could be something else. The default should probably be "off" (current behavior). It does sound like something that may be useful, particularly if the network in question doesn't document anywhere which mechanisms are supported, so the only way to find out is to try it yourself.

Ben

I like this proposal, though perhaps with an option. Something like: ``` /msg *sasl verbose on ``` or even... ``` /msg *sasl notify_failed on ``` The name of the option could be something else. The default should probably be "off" (current behavior). It does sound like something that may be useful, particularly if the network in question doesn't document anywhere which mechanisms are supported, so the only way to find out is to try it yourself. Ben

adam commented

2026-10-05 04:20:13 +02:00

This would be more important since https://github.com/znc/znc/commit/02ba375966a5713ff316a3e122fd1f57f575ebe6 now that all SASL mechanisms are enabled by default as some users are confused by error about EXTERNAL failing without any kind of notice on PLAIN succeeding instead.

This would be more important since https://github.com/znc/znc/commit/02ba375966a5713ff316a3e122fd1f57f575ebe6 now that all SASL mechanisms are enabled by default as some users are confused by error about EXTERNAL failing without any kind of notice on PLAIN succeeding instead.

adam commented

2026-10-05 04:20:13 +02:00

Frankly... I'd much prefer the SASL mechanism announcements be compacted into one line (like https://github.com/GLolol/znc/commit/9764bc5b41 though preferably in a notice instead of PRIVMSG).
👍 for putting all this mechanism stuff into a verbose option of some sort. Unless you're debugging, it doesn't really matter which mechanisms you have defined as long as one of them works.

Frankly... I'd much prefer the SASL mechanism announcements be compacted into one line (like https://github.com/GLolol/znc/commit/9764bc5b41 though preferably in a notice instead of PRIVMSG). :+1: for putting all this mechanism stuff into a `verbose` option of some sort. Unless you're debugging, it doesn't really matter which mechanisms you have defined as long as one of them works.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#426