Aidan Skinner wrote:
I believe it does, although this bug/difference of interpretation wouldn't manifest itself for any sane password (it only happens with certain high characters). I've had a look through the SASL source and it doesn't seem to do anything funky with the password inside itself. What do you read the password in as?
Its read in as essentially binary data into a std::string then passed to cyrus via a c-string.
As an aside, do you support hashed password files?
All support for authentication currently comes from what cyrus provides. Theres a config file in cpp/etc/sasl2 that authenticates against a db (an example of which, containing guest user, is created during the dist build).
Passwords are stored in the clear in the db though. Cyrus can also be setup to authenticate against the hosts userbase, ldap etc. I'm not _aware_ of any option to authenticate an application specific hashed password file, but that doesn't mean its not there (it could be built as a cyrus module if needed).
