Do not offer other SASL mechanisms than EXTERNAL to remote servers. JM-794

git-svn-id: http://svn.igniterealtime.org/svn/repos/wildfire/trunk@4769 b35dd754-fafc-0310-a699-88a17e54d16e

src/java/org/jivesoftware/wildfire/net/SASLAuthentication.java

@@ -116,10 +116,13 @@ public class SASLAuthentication {
         }
         StringBuilder sb = new StringBuilder(195);
         sb.append("<mechanisms xmlns=\"urn:ietf:params:xml:ns:xmpp-sasl\">");
-        if (session.getConnection().isSecure() && session instanceof IncomingServerSession) {
+        if (session instanceof IncomingServerSession) {
             // Server connections dont follow the same rules as clients
+            if (session.getConnection().isSecure()) {
+                // Offer SASL EXTERNAL only if TLS has already been negotiated
                 sb.append("<mechanism>EXTERNAL</mechanism>");
             }
+        }
         else {
             for (String mech : getSupportedMechanisms()) {
                 if (mech.equals("CRAM-MD5") || mech.equals("DIGEST-MD5")) {