horde/sasl

SASL authentication library

v1.0.0 2026-08-14 00:00 UTC

Requires

• php: ^8.1
• ext-hash: *
• ext-json: *
• horde/exception: ^3 || dev-FRAMEWORK_6_0
• horde/stringprep: ^2 || dev-FRAMEWORK_6_0

LGPL-2.1-only

• Ralf Lang

• Authentication
• sasl
• scram
• rfc4422

Published on Packagist.org on 2026-08-14 13:20 UTC

README

A role-generic, protocol-agnostic SASL (RFC 4422) library for PHP 8.1+ It implements both the client and server side of each mechanism.

What it is

horde/Sasl provides the authentication exchange mechanism. State machines that consume and produce raw octets. It intentionally does not handle IMAP/SMTP/POP3/ManageSieve wire framing (base64, tagging, line continuation). That is a protocol adapter's job, built on top of this library in the consuming package.

Supported mechanisms, client and server unless noted:

• ANONYMOUS (RFC 4505)
• PLAIN, LOGIN
• CRAM-MD5, DIGEST-MD5
• SCRAM-SHA-1, SCRAM-SHA-256, SCRAM-SHA-512 (+ their -PLUS channel-binding variants)
• OAUTHBEARER, XOAUTH2 (client only)
• EXTERNAL

Notable design points:

• Mechanisms are pure octet-in/octet-out state machines. No base64 or line framing inside the library.
• Real SCRAM channel binding (GS2 header + ChannelBindingProvider), not a hardcoded n,,.
• SASLprep username normalization via horde/stringprep.
• ClientMechanismFactory / ServerMechanismFactory plus a Negotiator and SaslPolicy for mechanism selection and minimum-strength TLS gating.

See doc/CAPABILITIES.md for a detailed capability comparison against pear/Auth_SASL2, the closest prior PHP SASL library.

History

horde/sasl was developed to replace the aging pear/Auth_SASL2 as well as inline implementations in horde/imap_client, horde/smtp and horde/managesieve libraries. It implements the server side according to RFC as far as it makes sense.

Installation

composer require horde/sasl

Testing

phpunit