.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.43)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings.  \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
.    ds -- \(*W-
.    ds PI pi
.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
.    ds L" ""
.    ds R" ""
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds -- \|\(em\|
.    ds PI \(*p
.    ds L" ``
.    ds R" ''
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\" ========================================================================
.\"
.IX Title "Authen::SASL::Perl 3pm"
.TH Authen::SASL::Perl 3pm "2023-09-24" "perl v5.36.0" "User Contributed Perl Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
Authen::SASL::Perl \-\- Perl implementation of the SASL Authentication framework
.SH "VERSION"
.IX Header "VERSION"
version 2.1700
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
.Vb 1
\& use Authen::SASL qw(Perl);
\&
\& $sasl = Authen::SASL\->new(
\&   mechanism => \*(AqCRAM\-MD5 PLAIN ANONYMOUS\*(Aq,
\&   callback => {
\&     user => $user,
\&     pass => \e&fetch_password
\&   }
\& );
.Ve
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
\&\fBAuthen::SASL::Perl\fR is the pure Perl implementation of \s-1SASL\s0 mechanisms
in the \fBAuthen::SASL\fR framework.
.PP
At the time of this writing it provides the client part implementation
for the following \s-1SASL\s0 mechanisms:
.IP "\s-1ANONYMOUS\s0" 4
.IX Item "ANONYMOUS"
The Anonymous \s-1SASL\s0 Mechanism as defined in \s-1RFC 2245\s0 resp. 
in \s-1IETF\s0 Draft draft\-ietf\-sasl\-anon\-03.txt from February 2004
provides a method to anonymously access internet services.
.Sp
Since it does no authentication it does not need to send 
any confidential information such as passwords in plain text
over the network.
.IP "\s-1CRAM\-MD5\s0" 4
.IX Item "CRAM-MD5"
The \s-1CRAM\-MD5 SASL\s0 Mechanism as defined in \s-1RFC2195\s0 resp.
in \s-1IETF\s0 Draft draft\-ietf\-sasl\-crammd5\-XX.txt
offers a simple challenge-response authentication mechanism.
.Sp
Since it is a challenge-response authentication mechanism
no passwords are transferred in clear-text over the wire.
.Sp
Due to the simplicity of the protocol \s-1CRAM\-MD5\s0 is susceptible
to replay and dictionary attacks, so \s-1DIGEST\-MD5\s0 should be used
in preference.
.IP "\s-1DIGEST\-MD5\s0" 4
.IX Item "DIGEST-MD5"
The \s-1DIGEST\-MD5 SASL\s0 Mechanism as defined in \s-1RFC 2831\s0 resp.
in \s-1IETF\s0 Draft draft\-ietf\-sasl\-rfc2831bis\-XX.txt
offers the \s-1HTTP\s0 Digest Access Authentication as \s-1SASL\s0 mechanism.
.Sp
Like \s-1CRAM\-MD5\s0 it is a challenge-response authentication
method that does not send plain text passwords over the network.
.Sp
Compared to \s-1CRAM\-MD5, DIGEST\-MD5\s0 prevents chosen plaintext
attacks, and permits the use of third party authentication servers,
so that it is recommended to use \s-1DIGEST\-MD5\s0 instead of \s-1CRAM\-MD5\s0
when possible.
.IP "\s-1EXTERNAL\s0" 4
.IX Item "EXTERNAL"
The \s-1EXTERNAL SASL\s0 mechanism as defined in \s-1RFC 2222\s0
allows the use of external authentication systems as \s-1SASL\s0 mechanisms.
.IP "\s-1GSSAPI\s0" 4
.IX Item "GSSAPI"
The \s-1GSSAPI SASL\s0 mechanism as defined in \s-1RFC 2222\s0 resp. \s-1IETF\s0 Draft
draft\-ietf\-sasl\-gssapi\-XX.txt allows using the Generic Security Service
Application Program Interface [\s-1GSSAPI\s0] \s-1KERBEROS V5\s0 as a \s-1SASL\s0 mechanism.
.Sp
Although \s-1GSSAPI\s0 is a general mechanism for authentication it is almost
exclusively used for Kerberos 5.
.IP "\s-1LOGIN\s0" 4
.IX Item "LOGIN"
The \s-1LOGIN SASL\s0 Mechanism as defined in \s-1IETF\s0 Draft
draft\-murchison\-sasl\-login\-XX.txt allows  the
combination of username and clear-text password to be used
in a \s-1SASL\s0 mechanism.
.Sp
It does not provide a security layer and sends the credentials
in clear over the wire.
Thus this mechanism should not be used without adequate security
protection.
.IP "\s-1PLAIN\s0" 4
.IX Item "PLAIN"
The Plain \s-1SASL\s0 Mechanism as defined in \s-1RFC 2595\s0 resp. \s-1IETF\s0 Draft
draft\-ietf\-sasl\-plain\-XX.txt is another \s-1SASL\s0 mechanism that allows
username and clear-text password combinations in \s-1SASL\s0 environments.
.Sp
Like \s-1LOGIN\s0 it sends the credentials in clear over the network
and should not be used without sufficient security protection.
.PP
As for server support, only \fI\s-1PLAIN\s0\fR, \fI\s-1LOGIN\s0\fR and \fI\s-1DIGEST\-MD5\s0\fR are supported
at the time of this writing.
.PP
\&\f(CW\*(C`server_new\*(C'\fR \s-1OPTIONS\s0 is a hashref that is only relevant for \fI\s-1DIGEST\-MD5\s0\fR for
now and it supports the following options:
.IP "\- no_integrity" 4
.IX Item "- no_integrity"
.PD 0
.IP "\- no_confidentiality" 4
.IX Item "- no_confidentiality"
.PD
.PP
which configures how the security layers are negotiated with the client (or
rather imposed to the client).
.SH "SEE ALSO"
.IX Header "SEE ALSO"
Authen::SASL,
Authen::SASL::Perl::ANONYMOUS,
Authen::SASL::Perl::CRAM_MD5,
Authen::SASL::Perl::DIGEST_MD5,
Authen::SASL::Perl::EXTERNAL,
Authen::SASL::Perl::GSSAPI,
Authen::SASL::Perl::LOGIN,
Authen::SASL::Perl::PLAIN
.SH "AUTHOR"
.IX Header "AUTHOR"
Peter Marschall <peter@adpm.de>
.PP
Please report any bugs, or post any suggestions, to the perl-ldap mailing list
<perl\-ldap@perl.org>
.SH "COPYRIGHT"
.IX Header "COPYRIGHT"
Copyright (c) 2004\-2006 Peter Marschall.
All rights reserved. This document is distributed, and may be redistributed,
under the same terms as Perl itself.