jstedfast/MailKit · error · NotSupportedException

LOGIN does not support SASL-IR.

Error message

LOGIN does not support SASL-IR.

What it means

The LOGIN SASL mechanism is a two-step username/password exchange and cannot carry the initial response (SASL-IR). If Challenge() is called with a non-null token while the mechanism still expects the username step, NotSupportedException is thrown. SASL-IR is only valid for mechanisms that define an initial client response.

Solutions

1. Do not pass an initial-response token; call Challenge (null, 0, 0) for the first step of the LOGIN exchange
2. Use PLAIN instead of LOGIN if you need SASL-IR support
3. Ensure the protocol driver you use does not emit SASL-IR for LOGIN (MailKit's built-in protocols handle this correctly)

Example fix

// before
mechanism.Challenge (Encoding.UTF8.GetBytes ("initial-response"), 0, len); // throws
// after
var tok = mechanism.Challenge (null, 0, 0); // first step: returns username
var tok2 = mechanism.Challenge (serverToken, 0, serverToken.Length); // returns password

// Only pass an initial response to mechanisms that support SASL-IR:
if (mechanism is SaslMechanismLogin)
    token = null; // LOGIN never supports SASL-IR
var first = mechanism.Challenge (token, 0, token?.Length ?? 0);

bool SupportsSaslIr (SaslMechanism m) => m is not SaslMechanismLogin;

try {
    mechanism.Challenge (ir, 0, ir.Length);
} catch (NotSupportedException) {
    // restart exchange with Challenge(null, 0, 0)
}

When it happens

Trigger: Passing an initial-response token to SaslMechanismLogin.Challenge(), or using a protocol layer that attempts SASL-IR (e.g. IMAP 'AUTHENTICATE LOGIN <ir>') with the LOGIN mechanism.

Common situations: Custom protocol implementations or test harnesses (AssertLogin, TestArgumentExceptions) that send an initial response token to all mechanisms uniformly; misconfigured clients forcing SASL-IR.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• No compatible authentication mechanisms found.
• Value cannot be null.
• Value cannot be null.
• MissingChallenge
• MissingChallenge

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/05fcad31f3370653. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Security/SaslMechanismLogin.cs:182

		/// The SASL mechanism does not support SASL-IR.
		/// </exception>
		/// <exception cref="System.OperationCanceledException">
		/// The operation was canceled via the cancellation token.
		/// </exception>
		/// <exception cref="SaslException">
		/// An error has occurred while parsing the server's challenge token.
		/// </exception>
		protected override byte[]? Challenge (byte[]? token, int startIndex, int length, CancellationToken cancellationToken)
		{
			if (IsAuthenticated)
				return null;

			byte[]? challenge = null;

			switch (state) {
			case LoginState.UserName:
				if (token == null)
					throw new NotSupportedException ("LOGIN does not support SASL-IR.");

				challenge = encoding.GetBytes (Credentials.UserName);
				state = LoginState.Password;
				break;
			case LoginState.Password:
				challenge = encoding.GetBytes (Credentials.Password);
				IsAuthenticated = true;
				break;
			}

			return challenge;
		}

		/// <summary>
		/// Resets the state of the SASL mechanism.
		/// </summary>
		/// <remarks>
		/// Resets the state of the SASL mechanism.

View on GitHub (pinned to 9d3859a785)