In the CramMD5Server.evaluateResponse() method
authorizationID does not get set after successful
authentication.
The following change fixes this problem:
// Compare the received and computed digests
if (!SaslUtil.areEqual(digest, responseDigest))
throw new SaslException("authentication error");
should be:
// Compare the received and computed digests
if (!SaslUtil.areEqual(digest, responseDigest))
throw new SaslException("authentication error");
else
authorizationID = username;
... WkH