Ejabberd: auth_method anonymous disables SCRAM-SHA-1 (Conversations stops working)

[radiocane]

After upgrading from 16.09-4 to 18.12.1 in Debian stretch I messed up the ejabberd.yml configuration and most of my Conversations user stopped logging in with "Degraded SASL mechanism".
Ejabberd was offering ANONYMOUS and PLAIN.
After disabling auth_method ANONYMOUS, ejabberd started offering PLAIN and SCRAM-SHA-1 again and all is well.
I suppose ANONYMOUS disabling SCRAM-SHA-1 is a bug.

[zinid]

The bug is confirmed.

[zinid]

For the record, the mechanisms selection is performed here: https://github.com/processone/ejabberd/blob/18.12.1/src/ejabberd_c2s.erl#L354
Since ejabberd_auth_anonymous:store_type/1 returns external (WTF???), SCRAM is ruled out.
After playing a bit with the code I decided that functions ejabberd_auth:store_type() and ejabberd_auth:plain_password_required are completely broken. For example, when auth_password_format is set to scram, then ejabberd_auth_mnesia:plain_password_required returns true (WTF???)

[Neustradamus]

Any news about it?

[Neustradamus]

@prefiks, @badlop, @mremond: Have you looked this security problem?
Thanks in advance.

[prefiks]

Should be fixed by d8d9ef32adf75caa93477692e0a423f8a4c4de6b

[Neustradamus]

Thanks @prefiks!

@radiocane: Can you test it?
It is now perfect?