14 files changed, 213 insertions, 27 deletions

diff --git a/src/command/cmd_ac.c b/src/command/cmd_ac.c
index 94081510..09de573c 100644
--- a/src/command/cmd_ac.c
+++ b/src/command/cmd_ac.c
@@ -195,6 +195,7 @@ static Autocomplete omemo_sendfile_ac;
 #endif
 static Autocomplete connect_property_ac;
 static Autocomplete tls_property_ac;
+static Autocomplete auth_property_ac;
 static Autocomplete alias_ac;
 static Autocomplete aliases_ac;
 static Autocomplete join_property_ac;
@@ -425,6 +426,7 @@ cmd_ac_init(void)
     autocomplete_add(account_set_ac, "pgpkeyid");
     autocomplete_add(account_set_ac, "startscript");
     autocomplete_add(account_set_ac, "tls");
+    autocomplete_add(account_set_ac, "auth");
     autocomplete_add(account_set_ac, "theme");
 
     account_clear_ac = autocomplete_new();
@@ -686,6 +688,7 @@ cmd_ac_init(void)
 #endif
 
     connect_property_ac = autocomplete_new();
+    autocomplete_add(connect_property_ac, "auth");
     autocomplete_add(connect_property_ac, "server");
     autocomplete_add(connect_property_ac, "port");
     autocomplete_add(connect_property_ac, "tls");
@@ -697,6 +700,10 @@ cmd_ac_init(void)
     autocomplete_add(tls_property_ac, "legacy");
     autocomplete_add(tls_property_ac, "disable");
 
+    auth_property_ac = autocomplete_new();
+    autocomplete_add(auth_property_ac, "default");
+    autocomplete_add(auth_property_ac, "legacy");
+
     join_property_ac = autocomplete_new();
     autocomplete_add(join_property_ac, "nick");
     autocomplete_add(join_property_ac, "password");
@@ -1263,6 +1270,7 @@ cmd_ac_reset(ProfWin *window)
 #endif
     autocomplete_reset(connect_property_ac);
     autocomplete_reset(tls_property_ac);
+    autocomplete_reset(auth_property_ac);
     autocomplete_reset(alias_ac);
     autocomplete_reset(aliases_ac);
     autocomplete_reset(join_property_ac);
@@ -1419,6 +1427,7 @@ cmd_ac_uninit(void)
 #endif
     autocomplete_free(connect_property_ac);
     autocomplete_free(tls_property_ac);
+    autocomplete_free(auth_property_ac);
     autocomplete_free(alias_ac);
     autocomplete_free(aliases_ac);
     autocomplete_free(join_property_ac);
@@ -3206,7 +3215,7 @@ _connect_autocomplete(ProfWin *window, const char *const input, gboolean previou
     char *found = NULL;
     gboolean result = FALSE;
 
-    gchar **args = parse_args(input, 1, 7, &result);
+    gchar **args = parse_args(input, 1, 9, &result);
 
     if (result) {
         gboolean space_at_end = g_str_has_suffix(input, " ");
@@ -3274,6 +3283,74 @@ _connect_autocomplete(ProfWin *window, const char *const input, gboolean previou
                 return found;
             }
         }
+        if ((num_args == 7 && space_at_end) || (num_args == 8 && !space_at_end)) {
+            GString *beginning = g_string_new("/connect");
+            g_string_append_printf(beginning, " %s %s %s %s %s %s %s", args[0], args[1], args[2], args[3], args[4], args[5], args[6]);
+            found = autocomplete_param_with_ac(input, beginning->str, connect_property_ac, TRUE, previous);
+            g_string_free(beginning, TRUE);
+            if (found) {
+                g_strfreev(args);
+                return found;
+            }
+        }
+        if ((num_args == 8 && space_at_end && (g_strcmp0(args[7], "tls") == 0))
+                || (num_args == 9 && (g_strcmp0(args[7], "tls") == 0) && !space_at_end))  {
+            GString *beginning = g_string_new("/connect");
+            g_string_append_printf(beginning, " %s %s %s %s %s %s %s %s", args[0], args[1], args[2], args[3], args[4], args[5], args[6], args[7]);
+            found = autocomplete_param_with_ac(input, beginning->str, tls_property_ac, TRUE, previous);
+            g_string_free(beginning, TRUE);
+            if (found) {
+                g_strfreev(args);
+                return found;
+            }
+        }
+
+        /* auth option */
+
+        if ((num_args == 2 && space_at_end && (g_strcmp0(args[1], "auth") == 0))
+                || (num_args == 3 && (g_strcmp0(args[1], "auth") == 0) && !space_at_end))  {
+            GString *beginning = g_string_new("/connect");
+            g_string_append_printf(beginning, " %s %s", args[0], args[1]);
+            found = autocomplete_param_with_ac(input, beginning->str, auth_property_ac, TRUE, previous);
+            g_string_free(beginning, TRUE);
+            if (found) {
+                g_strfreev(args);
+                return found;
+            }
+        }
+        if ((num_args == 4 && space_at_end && (g_strcmp0(args[3], "auth") == 0))
+                || (num_args == 5 && (g_strcmp0(args[3], "auth") == 0) && !space_at_end))  {
+            GString *beginning = g_string_new("/connect");
+            g_string_append_printf(beginning, " %s %s %s %s", args[0], args[1], args[2], args[3]);
+            found = autocomplete_param_with_ac(input, beginning->str, auth_property_ac, TRUE, previous);
+            g_string_free(beginning, TRUE);
+            if (found) {
+                g_strfreev(args);
+                return found;
+            }
+        }
+        if ((num_args == 6 && space_at_end && (g_strcmp0(args[5], "auth") == 0))
+                || (num_args == 7 && (g_strcmp0(args[5], "auth") == 0) && !space_at_end))  {
+            GString *beginning = g_string_new("/connect");
+            g_string_append_printf(beginning, " %s %s %s %s %s %s", args[0], args[1], args[2], args[3], args[4], args[5]);
+            found = autocomplete_param_with_ac(input, beginning->str, auth_property_ac, TRUE, previous);
+            g_string_free(beginning, TRUE);
+            if (found) {
+                g_strfreev(args);
+                return found;
+            }
+        }
+        if ((num_args == 8 && space_at_end && (g_strcmp0(args[7], "auth") == 0))
+                || (num_args == 9 && (g_strcmp0(args[7], "auth") == 0) && !space_at_end))  {
+            GString *beginning = g_string_new("/connect");
+            g_string_append_printf(beginning, " %s %s %s %s %s %s %s %s", args[0], args[1], args[2], args[3], args[4], args[5], args[6], args[7]);
+            found = autocomplete_param_with_ac(input, beginning->str, auth_property_ac, TRUE, previous);
+            g_string_free(beginning, TRUE);
+            if (found) {
+                g_strfreev(args);
+                return found;
+            }
+        }
     }
 
     g_strfreev(args);
@@ -3484,6 +3561,17 @@ _account_autocomplete(ProfWin *window, const char *const input, gboolean previou
                 return found;
             }
         }
+        if ((num_args == 3 && space_at_end && (g_strcmp0(args[2], "auth") == 0))
+                || (num_args == 4 && (g_strcmp0(args[2], "auth") == 0) && !space_at_end))  {
+            GString *beginning = g_string_new("/account");
+            g_string_append_printf(beginning, " %s %s %s", args[0], args[1], args[2]);
+            found = autocomplete_param_with_ac(input, beginning->str, auth_property_ac, TRUE, previous);
+            g_string_free(beginning, TRUE);
+            if (found) {
+                g_strfreev(args);
+                return found;
+            }
+        }
         if ((num_args == 3 && space_at_end && (g_strcmp0(args[2], "startscript") == 0))
                 || (num_args == 4 && (g_strcmp0(args[2], "startscript") == 0) && !space_at_end))  {
             GString *beginning = g_string_new("/account");
diff --git a/src/command/cmd_defs.c b/src/command/cmd_defs.c
index 70331542..85140430 100644
--- a/src/command/cmd_defs.c
+++ b/src/command/cmd_defs.c
@@ -160,7 +160,7 @@ static struct cmd_t command_defs[] =
             CMD_TAG_CONNECTION)
         CMD_SYN(
             "/connect [<account>]",
-            "/connect <account> [server <server>] [port <port>] [tls force|allow|trust|legacy|disable]")
+            "/connect <account> [server <server>] [port <port>] [tls force|allow|trust|legacy|disable] [auth default|legacy]")
         CMD_DESC(
             "Login to a chat service. "
             "If no account is specified, the default is used if one is configured. "
@@ -173,7 +173,9 @@ static struct cmd_t command_defs[] =
             { "tls allow",         "Use TLS for the connection if it is available." },
             { "tls trust",         "Force TLS connection and trust server's certificate." },
             { "tls legacy",        "Use legacy TLS for the connection. It means server doesn't support STARTTLS and TLS is forced just after TCP connection is established." },
-            { "tls disable",       "Disable TLS for the connection." })
+            { "tls disable",       "Disable TLS for the connection." },
+            { "auth default",      "Default authentication process." },
+            { "auth legacy",       "Allow legacy authentication." })
         CMD_EXAMPLES(
             "/connect",
             "/connect odin@valhalla.edda",
@@ -2003,6 +2005,7 @@ static struct cmd_t command_defs[] =
             "/account set <account> pgpkeyid <pgpkeyid>",
             "/account set <account> startscript <script>",
             "/account set <account> tls force|allow|trust|legacy|disable",
+            "/account set <account> auth default|legacy",
             "/account set <account> theme <theme>",
             "/account clear <account> password",
             "/account clear <account> eval_password",
@@ -2045,6 +2048,8 @@ static struct cmd_t command_defs[] =
             { "set <account> tls trust",                "Force TLS connection and trust server's certificate." },
             { "set <account> tls legacy",               "Use legacy TLS for the connection. It means server doesn't support STARTTLS and TLS is forced just after TCP connection is established." },
             { "set <account> tls disable",              "Disable TLS for the connection." },
+            { "set <account> auth default",             "Use default authentication process." },
+            { "set <account> auth legacy",              "Allow legacy authentication." },
             { "set <account> <theme>",                  "Set the UI theme for the account." },
             { "clear <account> server",                 "Remove the server setting for this account." },
             { "clear <account> port",                   "Remove the port setting for this account." },
diff --git a/src/command/cmd_funcs.c b/src/command/cmd_funcs.c
index 7329046a..1c13d12f 100644
--- a/src/command/cmd_funcs.c
+++ b/src/command/cmd_funcs.c
@@ -338,7 +338,7 @@ cmd_connect(ProfWin *window, const char *const command, gchar **args)
         return TRUE;
     }
 
-    gchar *opt_keys[] = { "server", "port", "tls", NULL };
+    gchar *opt_keys[] = { "server", "port", "tls", "auth", NULL };
     gboolean parsed;
 
     GHashTable *options = parse_options(&args[args[0] ? 1 : 0], opt_keys, &parsed);
@@ -364,6 +364,16 @@ cmd_connect(ProfWin *window, const char *const command, gchar **args)
         return TRUE;
     }
 
+    char *auth_policy = g_hash_table_lookup(options, "auth");
+    if (auth_policy &&
+            (g_strcmp0(auth_policy, "default") != 0) &&
+            (g_strcmp0(auth_policy, "legacy") != 0)) {
+        cons_bad_cmd_usage(command);
+        cons_show("");
+        options_destroy(options);
+        return TRUE;
+    }
+
     int port = 0;
     if (g_hash_table_contains(options, "port")) {
         char *port_str = g_hash_table_lookup(options, "port");
@@ -406,6 +416,8 @@ cmd_connect(ProfWin *window, const char *const command, gchar **args)
             account_set_port(account, port);
         if (tls_policy != NULL)
             account_set_tls_policy(account, tls_policy);
+        if (auth_policy != NULL)
+            account_set_auth_policy(account, auth_policy);
 
         // use password if set
         if (account->password) {
@@ -441,7 +453,7 @@ cmd_connect(ProfWin *window, const char *const command, gchar **args)
     } else {
         jid = g_utf8_strdown(user, -1);
         char *passwd = ui_ask_password();
-        conn_status = cl_ev_connect_jid(jid, passwd, altdomain, port, tls_policy);
+        conn_status = cl_ev_connect_jid(jid, passwd, altdomain, port, tls_policy, auth_policy);
         free(passwd);
     }
 
@@ -497,7 +509,7 @@ cmd_account_add(ProfWin *window, const char *const command, gchar **args)
         return TRUE;
     }
 
-    accounts_add(account_name, NULL, 0, NULL);
+    accounts_add(account_name, NULL, 0, NULL, NULL);
     cons_show("Account created.");
     cons_show("");
 
@@ -844,6 +856,20 @@ _account_set_tls(char *account_name, char *policy)
 }
 
 gboolean
+_account_set_auth(char *account_name, char *policy)
+{
+    if ((g_strcmp0(policy, "default") != 0)
+            && (g_strcmp0(policy, "legacy") != 0)) {
+        cons_show("Auth policy must be either default or legacy.");
+    } else {
+        accounts_set_auth_policy(account_name, policy);
+        cons_show("Updated auth policy for account %s: %s", account_name, policy);
+        cons_show("");
+    }
+    return TRUE;
+}
+
+gboolean
 _account_set_presence_priority(char *account_name, char *presence, char *priority)
 {
     int intval;
@@ -919,6 +945,7 @@ cmd_account_set(ProfWin *window, const char *const command, gchar **args)
     if (strcmp(property, "startscript") == 0)   return _account_set_startscript(account_name, value);
     if (strcmp(property, "theme") == 0)         return _account_set_theme(account_name, value);
     if (strcmp(property, "tls") == 0)           return _account_set_tls(account_name, value);
+    if (strcmp(property, "auth") == 0)          return _account_set_auth(account_name, value);
 
     if (valid_resource_presence_string(property)) {
         return _account_set_presence_priority(account_name, property, value);
diff --git a/src/config/account.c b/src/config/account.c
index daa2fc77..1fc13429 100644
--- a/src/config/account.c
+++ b/src/config/account.c
@@ -55,7 +55,7 @@ account_new(const gchar *const name, const gchar *const jid,
     const gchar *const otr_policy, GList *otr_manual, GList *otr_opportunistic,
     GList *otr_always,  const gchar *const omemo_policy, GList *omemo_enabled,
     GList *omemo_disabled, const gchar *const pgp_keyid, const char *const startscript,
-    const char *const theme, gchar *tls_policy)
+    const char *const theme, gchar *tls_policy, gchar *auth_policy)
 {
     ProfAccount *new_account = malloc(sizeof(ProfAccount));
     memset(new_account, 0, sizeof(ProfAccount));
@@ -175,6 +175,12 @@ account_new(const gchar *const name, const gchar *const jid,
         new_account->tls_policy = NULL;
     }
 
+    if (auth_policy != NULL) {
+        new_account->auth_policy = strdup(auth_policy);
+    } else {
+        new_account->auth_policy = NULL;
+    }
+
     return new_account;
 }
 
@@ -247,6 +253,7 @@ account_free(ProfAccount *account)
     free(account->startscript);
     free(account->theme);
     free(account->tls_policy);
+    free(account->auth_policy);
     g_list_free_full(account->otr_manual, g_free);
     g_list_free_full(account->otr_opportunistic, g_free);
     g_list_free_full(account->otr_always, g_free);
@@ -271,3 +278,9 @@ void account_set_tls_policy(ProfAccount *account, const char *tls_policy)
     free(account->tls_policy);
     account->tls_policy = strdup(tls_policy);
 }
+
+void account_set_auth_policy(ProfAccount *account, const char *auth_policy)
+{
+    free(account->auth_policy);
+    account->auth_policy = strdup(auth_policy);
+}
diff --git a/src/config/account.h b/src/config/account.h
index dd4b029e..deb0e31a 100644
--- a/src/config/account.h
+++ b/src/config/account.h
@@ -67,6 +67,7 @@ typedef struct prof_account_t {
     gchar *startscript;
     gchar *theme;
     gchar *tls_policy;
+    gchar *auth_policy;
 } ProfAccount;
 
 ProfAccount* account_new(const gchar *const name, const gchar *const jid,
@@ -78,12 +79,13 @@ ProfAccount* account_new(const gchar *const name, const gchar *const jid,
     const gchar *const otr_policy, GList *otr_manual, GList *otr_opportunistic,
     GList *otr_always, const gchar *const omemo_policy, GList *omemo_enabled,
     GList *omemo_disabled, const gchar *const pgp_keyid, const char *const startscript,
-    const char *const theme, gchar *tls_policy);
+    const char *const theme, gchar *tls_policy, gchar *auth_policy);
 char* account_create_connect_jid(ProfAccount *account);
 gboolean account_eval_password(ProfAccount *account);
 void account_free(ProfAccount *account);
 void account_set_server(ProfAccount *account, const char *server);
 void account_set_port(ProfAccount *account, int port);
 void account_set_tls_policy(ProfAccount *account, const char *tls_policy);
+void account_set_auth_policy(ProfAccount *account, const char *auth_policy);
 
 #endif
diff --git a/src/config/accounts.c b/src/config/accounts.c
index bb8dac7e..1c194a9a 100644
--- a/src/config/accounts.c
+++ b/src/config/accounts.c
@@ -121,7 +121,7 @@ accounts_reset_enabled_search(void)
 }
 
 void
-accounts_add(const char *account_name, const char *altdomain, const int port, const char *const tls_policy)
+accounts_add(const char *account_name, const char *altdomain, const int port, const char *const tls_policy, const char *const auth_policy)
 {
     // set account name and resource
     const char *barejid = account_name;
@@ -152,6 +152,9 @@ accounts_add(const char *account_name, const char *altdomain, const int port, co
     if (tls_policy) {
         g_key_file_set_string(accounts, account_name, "tls.policy", tls_policy);
     }
+    if (auth_policy) {
+        g_key_file_set_string(accounts, account_name, "auth.policy", auth_policy);
+    }
 
     Jid *jidp = jid_create(barejid);
 
@@ -326,12 +329,15 @@ accounts_get_account(const char *const name)
             tls_policy = NULL;
         }
 
+        gchar *auth_policy = g_key_file_get_string(accounts, name, "auth.policy", NULL);
+
         ProfAccount *new_account = account_new(name, jid, password, eval_password, enabled,
             server, port, resource, last_presence, login_presence,
             priority_online, priority_chat, priority_away, priority_xa,
             priority_dnd, muc_service, muc_nick, otr_policy, otr_manual,
             otr_opportunistic, otr_always, omemo_policy, omemo_enabled,
-            omemo_disabled,  pgp_keyid, startscript, theme, tls_policy);
+            omemo_disabled,  pgp_keyid, startscript, theme, tls_policy,
+            auth_policy);
 
         g_free(jid);
         g_free(password);
@@ -348,6 +354,7 @@ accounts_get_account(const char *const name)
         g_free(startscript);
         g_free(theme);
         g_free(tls_policy);
+        g_free(auth_policy);
 
         return new_account;
     }
@@ -736,6 +743,15 @@ accounts_set_tls_policy(const char *const account_name, const char *const value)
 }
 
 void
+accounts_set_auth_policy(const char *const account_name, const char *const value)
+{
+    if (accounts_account_exists(account_name)) {
+        g_key_file_set_string(accounts, account_name, "auth.policy", value);
+        _save_accounts();
+    }
+}
+
+void
 accounts_set_priority_online(const char *const account_name, const gint value)
 {
     if (accounts_account_exists(account_name)) {
diff --git a/src/config/accounts.h b/src/config/accounts.h
index 53b6b1e4..2cd4bcf6 100644
--- a/src/config/accounts.h
+++ b/src/config/accounts.h
@@ -48,7 +48,7 @@ char* accounts_find_all(const char *const prefix, gboolean previous, void *conte
 char* accounts_find_enabled(const char *const prefix, gboolean previous, void *context);
 void accounts_reset_all_search(void);
 void accounts_reset_enabled_search(void);
-void accounts_add(const char *jid, const char *altdomain, const int port, const char *const tls_policy);
+void accounts_add(const char *jid, const char *altdomain, const int port, const char *const tls_policy, const char *const auth_policy);
 int  accounts_remove(const char *jid);
 gchar** accounts_get_list(void);
 ProfAccount* accounts_get_account(const char *const name);
@@ -67,6 +67,7 @@ void accounts_set_muc_service(const char *const account_name, const char *const
 void accounts_set_muc_nick(const char *const account_name, const char *const value);
 void accounts_set_otr_policy(const char *const account_name, const char *const value);
 void accounts_set_tls_policy(const char *const account_name, const char *const value);
+void accounts_set_auth_policy(const char *const account_name, const char *const value);
 void accounts_set_last_presence(const char *const account_name, const char *const value);
 void accounts_set_last_status(const char *const account_name, const char *const value);
 void accounts_set_last_activity(const char *const account_name);
diff --git a/src/event/client_events.c b/src/event/client_events.c
index a7ee3028..96098ae0 100644
--- a/src/event/client_events.c
+++ b/src/event/client_events.c
@@ -61,10 +61,10 @@
 #endif
 
 jabber_conn_status_t
-cl_ev_connect_jid(const char *const jid, const char *const passwd, const char *const altdomain, const int port, const char *const tls_policy)
+cl_ev_connect_jid(const char *const jid, const char *const passwd, const char *const altdomain, const int port, const char *const tls_policy, const char *const auth_policy)
 {
     cons_show("Connecting as %s", jid);
-    return session_connect_with_details(jid, passwd, altdomain, port, tls_policy);
+    return session_connect_with_details(jid, passwd, altdomain, port, tls_policy, auth_policy);
 }
 
 jabber_conn_status_t
diff --git a/src/event/client_events.h b/src/event/client_events.h
index 87276331..3c0da3d9 100644
--- a/src/event/client_events.h
+++ b/src/event/client_events.h
@@ -38,7 +38,7 @@
 
 #include "xmpp/xmpp.h"
 
-jabber_conn_status_t cl_ev_connect_jid(const char *const jid, const char *const passwd, const char *const altdomain, const int port, const char *const tls_policy);
+jabber_conn_status_t cl_ev_connect_jid(const char *const jid, const char *const passwd, const char *const altdomain, const int port, const char *const tls_policy, const char *const auth_policy);
 jabber_conn_status_t cl_ev_connect_account(ProfAccount *account);
 
 void cl_ev_disconnect(void);
diff --git a/src/ui/console.c b/src/ui/console.c
index c7cecf61..8b6693e4 100644
--- a/src/ui/console.c
+++ b/src/ui/console.c
@@ -908,6 +908,9 @@ cons_show_account(ProfAccount *account)
     if (account->tls_policy) {
         cons_show   ("TLS policy        : %s", account->tls_policy);
     }
+    if (account->auth_policy) {
+        cons_show   ("Auth policy       : %s", account->auth_policy);
+    }
     if (account->last_presence) {
         cons_show   ("Last presence     : %s", account->last_presence);
     }
diff --git a/src/xmpp/connection.c b/src/xmpp/connection.c
index 18b177c6..78f72579 100644
--- a/src/xmpp/connection.c
+++ b/src/xmpp/connection.c
@@ -134,8 +134,10 @@ connection_shutdown(void)
 
 jabber_conn_status_t
 connection_connect(const char *const jid, const char *const passwd, const char *const altdomain, int port,
-    const char *const tls_policy)
+    const char *const tls_policy, const char *const auth_policy)
 {
+    long flags;
+
     assert(jid != NULL);
     assert(passwd != NULL);
 
@@ -175,15 +177,35 @@ connection_connect(const char *const jid, const char *const passwd, const char *
     xmpp_conn_set_jid(conn.xmpp_conn, jid);
     xmpp_conn_set_pass(conn.xmpp_conn, passwd);
 
+    flags = xmpp_conn_get_flags(conn.xmpp_conn);
+
     if (!tls_policy || (g_strcmp0(tls_policy, "force") == 0)) {
-        xmpp_conn_set_flags(conn.xmpp_conn, XMPP_CONN_FLAG_MANDATORY_TLS);
+        flags |= XMPP_CONN_FLAG_MANDATORY_TLS;
     } else if (g_strcmp0(tls_policy, "trust") == 0) {
-        xmpp_conn_set_flags(conn.xmpp_conn, XMPP_CONN_FLAG_MANDATORY_TLS);
-        xmpp_conn_set_flags(conn.xmpp_conn, XMPP_CONN_FLAG_TRUST_TLS);
+        flags |= XMPP_CONN_FLAG_MANDATORY_TLS;
+        flags |= XMPP_CONN_FLAG_TRUST_TLS;
     } else if (g_strcmp0(tls_policy, "disable") == 0) {
-        xmpp_conn_set_flags(conn.xmpp_conn, XMPP_CONN_FLAG_DISABLE_TLS);
+        flags |= XMPP_CONN_FLAG_DISABLE_TLS;
     } else if (g_strcmp0(tls_policy, "legacy") == 0) {
-        xmpp_conn_set_flags(conn.xmpp_conn, XMPP_CONN_FLAG_LEGACY_SSL);
+        flags |= XMPP_CONN_FLAG_LEGACY_SSL;
+    }
+
+    if (auth_policy && (g_strcmp0(auth_policy, "legacy") == 0)) {
+        flags |= XMPP_CONN_FLAG_LEGACY_AUTH;
+    }
+
+    xmpp_conn_set_flags(conn.xmpp_conn, flags);
+
+    /* Print debug logs that can help when users share the logs */
+    if (flags != 0) {
+        log_debug("Connecting with flags (0x%lx):", flags);
+#define LOG_FLAG_IF_SET(name) if (flags & name) { log_debug("  " #name); }
+        LOG_FLAG_IF_SET(XMPP_CONN_FLAG_MANDATORY_TLS);
+        LOG_FLAG_IF_SET(XMPP_CONN_FLAG_TRUST_TLS);
+        LOG_FLAG_IF_SET(XMPP_CONN_FLAG_DISABLE_TLS);
+        LOG_FLAG_IF_SET(XMPP_CONN_FLAG_LEGACY_SSL);
+        LOG_FLAG_IF_SET(XMPP_CONN_FLAG_LEGACY_AUTH);
+#undef LOG_FLAG_IF_SET
     }
 
 #ifdef HAVE_LIBMESODE
diff --git a/src/xmpp/connection.h b/src/xmpp/connection.h
index 3a4dc133..016a9d92 100644
--- a/src/xmpp/connection.h
+++ b/src/xmpp/connection.h
@@ -43,7 +43,7 @@ void connection_shutdown(void);
 void connection_check_events(void);
 
 jabber_conn_status_t connection_connect(const char *const fulljid, const char *const passwd, const char *const altdomain, int port,
-    const char *const tls_policy);
+    const char *const tls_policy, const char *const auth_policy);
 void connection_disconnect(void);
 void connection_set_disconnected(void);
 
diff --git a/src/xmpp/session.c b/src/xmpp/session.c
index 0616f7a8..334c95a7 100644
--- a/src/xmpp/session.c
+++ b/src/xmpp/session.c
@@ -79,6 +79,7 @@ static struct {
     char *altdomain;
     int port;
     char *tls_policy;
+    char *auth_policy;
 } saved_details;
 
 typedef enum {
@@ -135,7 +136,8 @@ session_connect_with_account(const ProfAccount *const account)
         account->password,
         account->server,
         account->port,
-        account->tls_policy);
+        account->tls_policy,
+        account->auth_policy);
     free(jid);
 
     return result;
@@ -143,7 +145,7 @@ session_connect_with_account(const ProfAccount *const account)
 
 jabber_conn_status_t
 session_connect_with_details(const char *const jid, const char *const passwd, const char *const altdomain,
-    const int port, const char *const tls_policy)
+    const int port, const char *const tls_policy, const char *const auth_policy)
 {
     assert(jid != NULL);
     assert(passwd != NULL);
@@ -169,6 +171,11 @@ session_connect_with_details(const char *const jid, const char *const passwd, co
     } else {
         saved_details.tls_policy = NULL;
     }
+    if (auth_policy) {
+        saved_details.auth_policy = strdup(auth_policy);
+    } else {
+        saved_details.auth_policy = NULL;
+    }
 
     // use 'profanity' when no resourcepart in provided jid
     Jid *jidp = jid_create(jid);
@@ -191,7 +198,8 @@ session_connect_with_details(const char *const jid, const char *const passwd, co
         passwd,
         saved_details.altdomain,
         saved_details.port,
-        saved_details.tls_policy);
+        saved_details.tls_policy,
+        saved_details.auth_policy);
 }
 
 void
@@ -292,7 +300,7 @@ session_login_success(gboolean secured)
     // logged in without account, use details to create new account
     } else {
         log_debug("Connection handler: logged in with jid: %s", saved_details.name);
-        accounts_add(saved_details.name, saved_details.altdomain, saved_details.port, saved_details.tls_policy);
+        accounts_add(saved_details.name, saved_details.altdomain, saved_details.port, saved_details.tls_policy, saved_details.auth_policy);
         accounts_set_jid(saved_details.name, saved_details.jid);
 
         saved_account.name = strdup(saved_details.name);
@@ -511,7 +519,7 @@ _session_reconnect(void)
     }
 
     log_debug("Attempting reconnect with account %s", account->name);
-    connection_connect(jid, saved_account.passwd, account->server, account->port, account->tls_policy);
+    connection_connect(jid, saved_account.passwd, account->server, account->port, account->tls_policy, account->auth_policy);
     free(jid);
     account_free(account);
     g_timer_start(reconnect_timer);
@@ -532,5 +540,6 @@ _session_free_saved_details(void)
     FREE_SET_NULL(saved_details.passwd);
     FREE_SET_NULL(saved_details.altdomain);
     FREE_SET_NULL(saved_details.tls_policy);
+    FREE_SET_NULL(saved_details.auth_policy);
 }
 
diff --git a/src/xmpp/xmpp.h b/src/xmpp/xmpp.h
index 5fd56733..1444cffe 100644
--- a/src/xmpp/xmpp.h
+++ b/src/xmpp/xmpp.h
@@ -164,7 +164,7 @@ typedef struct prof_message_t {
 
 void session_init(void);
 jabber_conn_status_t session_connect_with_details(const char *const jid, const char *const passwd,
-    const char *const altdomain, const int port, const char *const tls_policy);
+    const char *const altdomain, const int port, const char *const tls_policy, const char *const auth_policy);
 jabber_conn_status_t session_connect_with_account(const ProfAccount *const account);
 void session_disconnect(void);
 void session_shutdown(void);