CSSMTP Suppport for SASL Methods PLAIN and KERBEROS

CSSMTP Suppport for SASL Methods PLAIN and KERBEROS.

Our Security Department requires any Mail Sender
to identify itself via 'Simple Authentication and Security Layer' (SASL).

Three SASL Methods would fulfill that requirement:

a) Method PLAIN.
A Mail Sender must authenticate itself via Userid and Password before Mail is accepted. Identity provided by Userid and Password must match the identity given in SMTP Header MAIL FROM:

b) Method Kerberos.
A Mail Sender must provide Kerberos Credentials that must match the identity given in SMTP Header MAIL FROM:

c) Method NTLMV2
A Mail Sender must provide NTLMv2 credentials that must match the identity given in SMTP Header MAIL FROM:

RFC4954 describes SMTP commands to implement SASL.

RFC4422 describes SASL in general.

There are specific RFCs that describe each SASL Method.

CSSMTP should be enhanced to support above mentioned SASL methods.

We want CSSMTP to authenticate itself with its started task user credentials.

CSSMTP is not required to use credentials learned from JES Submitter userid.

CSSMTP uses our Microsoft Exchange Mail Server as its target.

Microsoft Exchange Server verifies CSSMTP credentials if CSSMTP is allowed to send mail on behalf of the actual sender (taken from MAIL FROM header).

CSSMTP should prepare and conduct SASL negotiation.

The flow could be like:
1) CSSMTP reads mail from JES Spool and verifies JES Job Submitter is allowed to send mail.
2) CSSMTP reads HELO or EHLO command
3) CSSMTP reads MAIL FROM command. Here CSSMTP might match JES Job Submitter and MAIL FROM identity.
4) CSSMTP prepares credentials for one of the supported SASL methods.
This includes communication with RACF.
5) CSSMTP starts communication with MAIL Target Server.
Communication might be unsecured, which is suitable for method KERBEROS.
Communication must be TLS secured to allow method PLAIN.
6) CSSMTP conducts SASL negotiation.
7) CSSMTP sends actual Mail items.