Correct me if I'm wrong.

See my second reply. Basically, saslauthd will do what you want.

Realize we use GSSAPI and not local passwords or sasldb here, so if it didn't support pluggable backends, we'd be sad.