SASL authentication
SASL (Simple Authentication and Security Layer), defined in RFC 4422, is a general-purpose framework that lets a protocol like SMTP, IMAP, or LDAP plug in a choice of authentication mechanisms -- PLAIN, LOGIN, CRAM-MD5, OAUTHBEARER, and others -- without the base protocol needing to define its own authentication scheme or be rewritten every time a new one is adopted. For mail, RFC 4954 adds the SMTP AUTH extension, which lets a mail client authenticate to a server using any SASL mechanism the server advertises before it's allowed to submit messages for relay -- this is what stops an SMTP server from being an open relay anyone can send mail through. Because mechanisms like PLAIN and LOGIN send credentials with only base64 encoding, not encryption, SASL authentication is expected to run inside an already-encrypted connection, typically established with STARTTLS first, rather than over a plaintext one.
By AdminKit team, Netbase JSC · Updated