Creating addressspace connector to RabbitMQ server (3.8.3) fails using SASL PLAIN

[k-wall]

I'm trying to configure a connector to an external RabbitMQ server (3.8.3) using SASL PLAIN authentication with Rabbit configured using its AMQP-1.0 plugin. The connections from the router fail like this:

2020-05-04 07:12:36.880810 +0000 SERVER (trace) [123]:FRAME: 0 <- @sasl-mechanisms(64) [sasl-server-mechanisms=@PN_SYMBOL[:ANONYMOUS, :PLAIN, :AMQPLAIN]]
2020-05-04 07:12:36.881225 +0000 SERVER (trace) [123]:FRAME: 0 -> @sasl-init(65) [mechanism=:PLAIN, initial-response=b"guest\x00guest\x00guest"]
2020-05-04 07:12:40.002810 +0000 SERVER (trace) [2]:FRAME: 0 <- (EMPTY FRAME)
2020-05-04 07:12:40.136967 +0000 SERVER (trace) [123]:FRAME:   -> EOS

Looking at the RabbitMQ log, I see:

{handshake_error,starting,0,{'v1_0.error',{symbol,<<"amqp:decode-error">>},{utf8,<<"response <<103,117,101,115,116,0,103,117,101,115,116,0,103,117,101,115,116>> invalid">>},undefined}}
2020-05-04 15:12:54.193 [info] <0.4280.0> accepting AMQP connection <0.4280.0> (192.168.1.124:33328 -> 192.168.1.111:5672)

I think the issue is the Rabbit's SASL implementation is reject the authzid part of the SASL PLAIN initial response:

103,117,101,115,116,0,103,117,101,115,116,0,103,117,101,115,116
guest\0guest\0guest

I notice that authentication with another client (Qpid JMS which doesn't send an authz part) for instance this works

[1485300030:0] <- SASL
[1485300030:0] <- SaslMechanisms{saslServerMechanisms=[ANONYMOUS, PLAIN, AMQPLAIN]}
[1485300030:0] -> SaslInit{mechanism=PLAIN, initialResponse=\x00guest\x00guest, hostname='192.168.1.111'}
[1485300030:0] <- SaslOutcome{_code=OK, _additionalData=null}

[k-wall]

I notice this comment explain that authzid is not accepted. I think this would be a RabbitMQ issue. The spec indicates it is legal for the client to supply a authzid, RabbitMQ shouldn't really be rejecting it if authzid = authcid (which is does here).

I do not know Cyrus at all. From a quick look, I don't see a way to tell Qpid Dispatch/Qpid Proton not to send an authzid.