horde/Sasl

A role-generic, protocol-agnostic SASL (RFC 4422) library for PHP 8.1+ It implements both the client and server side of each mechanism.

What it is

horde/Sasl provides the authentication exchange mechanism. State machines that consume and produce raw octets. It intentionally does not handle IMAP/SMTP/POP3/ManageSieve wire framing (base64, tagging, line continuation). That is a protocol adapter's job, built on top of this library in the consuming package.

Supported mechanisms, client and server unless noted:

• ANONYMOUS (RFC 4505)
• PLAIN, LOGIN
• CRAM-MD5, DIGEST-MD5
• SCRAM-SHA-1, SCRAM-SHA-256, SCRAM-SHA-512 (+ their -PLUS channel-binding variants)
• OAUTHBEARER, XOAUTH2 (client only)
• EXTERNAL

Notable design points:

• Mechanisms are pure octet-in/octet-out state machines. No base64 or line framing inside the library.
• Real SCRAM channel binding (GS2 header + ChannelBindingProvider), not a hardcoded n,,.
• SASLprep username normalization via horde/stringprep.
• ClientMechanismFactory / ServerMechanismFactory plus a Negotiator and SaslPolicy for mechanism selection and minimum-strength TLS gating.

See doc/CAPABILITIES.md for a detailed capability comparison against pear/Auth_SASL2, the closest prior PHP SASL library.

History

horde/sasl was developed to replace the aging pear/Auth_SASL2 as well as inline implementations in horde/imap_client, horde/smtp and horde/managesieve libraries. It implements the server side according to RFC as far as it makes sense.

Installation

composer require horde/sasl

Testing

phpunit