Password authentication fails with not-authorized and stored password lost on restart

[mremond]

Summary

Authentication repeatedly fails with a not-authorized (invalid username or password) error even when the correct password is entered. After restarting the application, the stored password is lost and must be re-entered.

Observed Behaviour

• Authentication attempts using SASL SCRAM-SHA-1 (offered: SCRAM-SHA-1, PLAIN) fail with not-authorized - invalid username or password.
• The client falls back from a FAST token (not available) to password authentication, which also fails.
• SASL timeouts occur after 15000ms following the failed auth attempts.
• After restarting the application, the previously saved password is no longer present and has to be entered again.
• Later, a stream error connection-timeout - idle connection and a TLS read error (peer closed connection without sending TLS close_notify) are logged, followed by a clean socket disconnect (code 1000).

Expected Behaviour

• A correct password should authenticate successfully.
• The password should persist across application restarts and not require re-entry.

Additional Context

Connection/DNS details from the logs:

• SRV lookups for _xmpps-client._tcp and _xmpp-client._tcp failed with DNS error: Not Implemented, falling back to conversations.im:5222 (STARTTLS).
• TCP connect and STARTTLS/TLS handshake completed successfully before the authentication failures.
• One early error: WebSocket ECONNERROR wss://xmpp.conversations.im:443/websocket.

Relevant Log Excerpts

[Fluux] Auth: password (SASL: SCRAM-SHA-1, offered: SCRAM-SHA-1, PLAIN)
[Fluux] Stream error: not-authorized - invalid username or password
[XMPP] Authentication failed: not-authorized
[Fluux] Connection error: not-authorized - Invalid username or password
[Fluux] SASL timeout after 15000ms
[Fluux] FAST token not available, falling back to password
[Fluux] Stream error: connection-timeout - idle connection
TLS read error error=peer closed connection without sending TLS close_notify