Diff

--- a/plugins/mod_saslauth.lua	Sat Feb 03 17:36:55 2018 +0100
+++ b/plugins/mod_saslauth.lua	Sun Feb 04 01:40:11 2018 +0100
@@ -110,9 +110,14 @@
 	module:log("info", "SASL EXTERNAL with %s failed: %s", session.to_host, condition);
 
 	session.external_auth = "failed"
-	session:close();
+	session.external_auth_failure_reason = condition;
+end, 500)
+
+module:hook_tag(xmlns_sasl, "failure", function (session, stanza) -- luacheck: ignore 212/stanza
+	session.log("debug", "No fallback from SASL EXTERNAL failure, giving up");
+	session:close(nil, session.external_auth_failure_reason);
 	return true;
-end, 500)
+end, 90)
 
 module:hook_tag("http://etherx.jabber.org/streams", "features", function (session, stanza)
 	if session.type ~= "s2sout_unauthed" or not session.secure then return; end