SASL authentication fails when multiple mechanisms are available

[git-developer]

Problem

SASL authentication fails when both server and client support more than 1 SASL mechanism.

Environment to reproduce the bug

• Client: Debian Buster with package libauthen-sasl-cyrus-perl
  Actual version was 0.13-server-10+b5
• Server: Prosody (stable) configured for multiple mechanisms.
  Actual server was jabber.de supporting PLAIN and SCRAM-SHA-1
• Debug log:

  XML::Stream: Read: buff(<?xml version='1.0'?><stream:stream version='1.0' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' xml:lang='en' id='***uuid***' from='jabber.de'><stream:features><register xmlns='http://jabber.org/features/iq-register'/><mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'><mechanism>SCRAM-SHA-1</mechanism><mechanism>PLAIN</mechanism></mechanisms></stream:features>)
  [...]
  XMPP::Conn: AuthSASL: shiney new auth
  XML::Stream: Send: (<auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='SCRAM-SHA-1 PLAIN'>***credentials***</auth>)
  XMPP::Conn: AuthSASL: haven't authed yet... let's wait.
  XMPP::Conn: Process: timeout(1)
  XML::Stream: Read: buff(<failure xmlns='urn:ietf:params:xml:ns:xmpp-sasl'><invalid-mechanism/></failure>)
  

Cause

• The problem is caused by the invalid attribute mechanism='SCRAM-SHA-1 PLAIN' in the client request. It should not contain both supported mechanisms.
• Removal of the package libauthen-sasl-cyrus-perl - which effectively means removing support for SCRAM-SHA-1 on the client side - fixes the problem:

  XML::Stream: Read: buff(<?xml version='1.0'?><stream:stream version='1.0' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' xml:lang='en' id='***uuid***' from='jabber.de'><stream:features><register xmlns='http://jabber.org/features/iq-register'/><mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'><mechanism>SCRAM-SHA-1</mechanism><mechanism>PLAIN</mechanism></mechanisms></stream:features>)
  [...]
  XMPP::Conn: AuthSASL: shiney new auth
  XML::Stream: Send: (<auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='PLAIN'>***credentials***</auth>)
  XMPP::Conn: AuthSASL: haven't authed yet... let's wait.
  XMPP::Conn: Process: timeout(1)
  XML::Stream: Read: buff(<success xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>)
  

• Root cause seems to be XML/Stream.pm where all available mechanisms are concatenated:

      my $sasl = Authen::SASL->new(mechanism=>join(" ",@{$mechanisms}),

The same line can be found in Net/XMPP/Protocol.pm.

Related issues

• Add ability to specify SASL mechanisms to use #7
• Implemented choosing of SASL auth mechanisms. Net-XMPP#19