OF-1322 Do not do EXTERNAL without trusted cert (#786)

src/java/org/jivesoftware/openfire/net/SASLAuthentication.java

@@ -196,6 +196,24 @@ public class SASLAuthentication {
     {
         final Element result = DocumentHelper.createElement( new QName( "mechanisms", new Namespace( "", SASL_NAMESPACE ) ) );
         for (String mech : getSupportedMechanisms()) {
+            if (mech.equals("EXTERNAL")) {
+                boolean trustedCert = false;
+                if (session.isSecure()) {
+                    final LocalClientSession localClientSession = (LocalClientSession)session;
+                    if (localClientSession != null) {
+                        final Connection connection = localClientSession.getConnection();
+                        final KeyStore keyStore = connection.getConfiguration().getIdentityStore().getStore();
+                        final KeyStore trustStore = connection.getConfiguration().getTrustStore().getStore();
+                        final X509Certificate trusted = CertificateManager.getEndEntityCertificate(connection.getPeerCertificates(), keyStore, trustStore);
+                        if (trusted != null) {
+                            trustedCert = true;
+                        }
+                    }
+                }
+                if (trustedCert == false) {
+                    continue; // Do not offer EXTERNAL.
+                }
+            }
             final Element mechanism = result.addElement("mechanism");
             mechanism.setText(mech);
         }