Merge 0.10->trunk

1 files changed, 13 insertions, 4 deletions

diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua
index 9917c303..68c4fe64 100644
--- a/plugins/mod_saslauth.lua
+++ b/plugins/mod_saslauth.lua
@@ -5,7 +5,7 @@
 -- This project is MIT/X11 licensed. Please see the
 -- COPYING file in the source package for more information.
 --
-
+-- luacheck: ignore 431/log
 
 
 local st = require "util.stanza";
@@ -223,8 +223,10 @@ local bind_attr = { xmlns='urn:ietf:params:xml:ns:xmpp-bind' };
 local xmpp_session_attr = { xmlns='urn:ietf:params:xml:ns:xmpp-session' };
 module:hook("stream-features", function(event)
 	local origin, features = event.origin, event.features;
+	local log = origin.log or log;
 	if not origin.username then
 		if secure_auth_only and not origin.secure then
+			log("debug", "Not offering authentication on insecure connection");
 			return;
 		end
 		local sasl_handler = usermanager_get_sasl_handler(module.host, origin)
@@ -243,15 +245,22 @@ module:hook("stream-features", function(event)
 			end
 		end
 		local mechanisms = st.stanza("mechanisms", mechanisms_attr);
-		for mechanism in pairs(sasl_handler:mechanisms()) do
-			if (not disabled_mechanisms:contains(mechanism)) and (origin.secure or not insecure_mechanisms:contains(mechanism)) then
+		local sasl_mechanisms = sasl_handler:mechanisms()
+		for mechanism in pairs(sasl_mechanisms) do
+			if disabled_mechanisms:contains(mechanism) then
+				log("debug", "Not offering disabled mechanism %s", mechanism);
+			elseif not origin.secure and insecure_mechanisms:contains(mechanism) then
+				log("debug", "Not offering mechanism %s on insecure connection", mechanism);
+			else
 				mechanisms:tag("mechanism"):text(mechanism):up();
 			end
 		end
 		if mechanisms[1] then
 			features:add_child(mechanisms);
+		elseif not next(sasl_mechanisms) then
+			log("warn", "No available SASL mechanisms, verify that the configured authentication module is working");
 		else
-			(origin.log or log)("warn", "No SASL mechanisms to offer");
+			log("warn", "All available authentication mechanisms are either disabled or not suitable for an insecure connection");
 		end
 	else
 		features:tag("bind", bind_attr):tag("required"):up():up();