RFC 2554 (rfc2554) - Page 2 of 11

SMTP Service Extension for Authentication

RFC 2554                  SMTP Authentication                 March 1999


   (3) The AUTH EHLO keyword contains as a parameter a space separated
       list of the names of supported SASL mechanisms.

   (4) a new SMTP verb "AUTH" is defined

   (5) an optional parameter using the keyword "AUTH" is added to the
       MAIL FROM command, and extends the maximum line length of the
       MAIL FROM command by 500 characters.

   (6) this extension is appropriate for the submission protocol
       [SUBMIT].


4. The AUTH command

   AUTH mechanism [initial-response]

     Arguments:
         a string identifying a SASL authentication mechanism.
         an optional base64-encoded response

     Restrictions:
         After an AUTH command has successfully completed, no more AUTH
         commands may be issued in the same session.  After a successful
         AUTH command completes, a server MUST reject any further AUTH
         commands with a 503 reply.

         The AUTH command is not permitted during a mail transaction.

     Discussion:
         The AUTH command indicates an authentication mechanism to the
         server.  If the server supports the requested authentication
         mechanism, it performs an authentication protocol exchange to
         authenticate and identify the user.  Optionally, it also
         negotiates a security layer for subsequent protocol
         interactions.  If the requested authentication mechanism is not
         supported, the server rejects the AUTH command with a 504
         reply.

         The authentication protocol exchange consists of a series of
         server challenges and client answers that are specific to the
         authentication mechanism.  A server challenge, otherwise known
         as a ready response, is a 334 reply with the text part
         containing a BASE64 encoded string.  The client answer consists
         of a line containing a BASE64 encoded string.  If the client
         wishes to cancel an authentication exchange, it issues a line
         with a single "*".  If the server receives such an answer, it
         MUST reject the AUTH command by sending a 501 reply.



Myers                       Standards Track