diff --git a/.mkdocs.yml b/.mkdocs.yml
index 3e90eec17..60f15352d 100644
--- a/.mkdocs.yml
+++ b/.mkdocs.yml
@@ -71,6 +71,8 @@ nav:
 - reference/auth/dovecot_sasl.md
 - reference/auth/plain_separate.md
 - reference/auth/netauth.md
+ - reference/auth/tls.md
+ - reference/auth/oauth.md
 - reference/config-syntax.md
 - Integration with software:
 - third-party/dovecot.md
diff --git a/Dockerfile b/Dockerfile
index 2da6211f4..dec3e4a72 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.23-alpine AS build-env
+FROM golang:1.25-alpine AS build-env
 
 ARG ADDITIONAL_BUILD_TAGS=""
 
diff --git a/docs/reference/auth/oauth.md b/docs/reference/auth/oauth.md
new file mode 100644
index 000000000..b1e3388d5
--- /dev/null
+++ b/docs/reference/auth/oauth.md
@@ -0,0 +1,172 @@
+# OAuth Bearer Token Authentication
+
+`auth.oauth` implements OAuth Bearer Token authentication as defined
+in [RFC 7628][rfc7628] and [RFC 6750][rfc6750].
+
+It is not compatible with non-standard XOAUTH2 implementations, such as those
+used by Google and Microsoft.
+
+The provided token can be validated either by the server directly by decoding
+JWT, or by making an introspection request ([RFC 7662][rfc7662]) to the
+authorization server to validate the token and retrieve associated metadata.
+
+## Configuration directives
+
+```
+auth.oauth [<url>] {
+ [debug yes &#124; no]
+ [introspection auth &#124; get &#124; post &#124; local]
+ [introspection_url <url>]
+ [http_header <key> <value>]
+ [http_header <key> <value> ...]
+ [introspection_timeout 5s]
+ [scopes <scope...>]
+ [username_attribute <attribute>]
+ [active_attribute active]
+ [active_value true]
+ [jwt_key_id_template <template>]
+ [jwt_key_table <table class="undef">]
+ [jwt_valid_methods <method...>]
+ [jwt_issuers <issuer...>]
+ [jwt_expiry_leeway <duration>]
+ [jwt_audience <table class="undef">]
+}
+```
+
+### debug _yes&#124;no_
+Default: no
+
+Enables debug logging.
+
+---
+
+### introspection _auth&#124;get&#124;post&#124;local_
+Default: auth
+
+Defines the method used to validate the token. The following options are available:
+- `auth`: Add token to the `Authorization` header and make a request to the introspection endpoint.
+- `get`: Make a GET request to the introspection endpoint with the token appended to the URL.
+- `post`: Make a POST request to the introspection endpoint with the token as `token` form-data field.
+- `local`: Validate the token locally by decoding it as a JWT.
+
+---
+
+### introspection_url _<url>_
+Default: (none)
+
+The URL of the introspection endpoint to validate the token. Required if `introspection_method` is set
+to `auth`, `get`, or `post`.
+
+---
+
+### http_header _<key> <value>_
+Default: (none)
+
+Additional HTTP headers to include in the introspection request. This can be used to provide server
+credentials or other necessary information to the authorization server.
+
+---
+
+### introspection_timeout _<duration>_
+Default: 5s
+
+The timeout for the introspection request. If the request takes longer than this duration, authentication
+will fail.
+
+---
+
+### scopes _<scope>_
+Default: (none)
+
+The required scope(s) for the token. If specified, the token must include all scopes to be
+considered valid.
+
+---
+
+### username_attribute _<attribute>_
+Default: email
+
+The attribute in the token response that contains the username. This is used to set the username for the
+authenticated user.
+
+If attribute is a list of strings, the first non-empty value will be used as the username.
+
+If client requests a specific username (e.g. via SASL authorization identity), it must match
+the username extracted from the token for authentication to succeed. If attribute is a
+list then the client requested username must match at least one of the values in the list.
+
+---
+
+### active_attribute _<attribute>_
+Default: not specified
+
+The attribute in the token response that indicates whether the token is active. This is used to determine if the
+token is valid. If not specified, the token is considered active if the introspection request returns
+a successful response.
+
+---
+
+### active_value _<value>_
+Default: not specified
+
+The value of the `active_attribute` that indicates the token is active. This is used to determine if the token is
+valid. If not specified, the token is considered active if the `active_attribute` is present and has a truthy value
+(not empty string, non-zero number, or boolean true).
+
+---
+
+### jwt_key_id_template _<template\>_
+Default: `{kid}`
+
+The template used to determine the key for `jwt_key_table` lookup. The template can include placeholders
+for JWT header and body fields: azp, kid, alg. If azp or kid is missing from the token, the placeholder will be
+replaced with `default`.
+
+---
+
+### jwt_key_table _<table class="undef">_
+Default: (none)
+
+The table to use for looking up the key to validate JWT tokens. The lookup key is determined by applying
+the `jwt_key_id_template` to the token's header and body fields.
+
+Most `storage.blob` (including file and s3) can be used here as well as they
+all also implement the `table` interface.
+
+---
+
+### jwt_valid_methods _<method\>_
+Default: all supported methods.
+
+The allowed signing algorithms for JWT tokens. If specified, the token's `alg` header field must match
+one of these values to be considered valid.
+
+It is not possible to enable `none` algorithm for JWT tokens.
+
+---
+
+### jwt_issuers _<issuer\>_
+Default: (none)
+
+If specified, the token's `iss` claim must match one of these values to be considered valid.
+
+---
+
+### jwt_expiry_leeway _<duration\>_
+Default: 30s
+
+The leeway to apply when validating the token's `exp` claim. This allows for some clock skew between the
+token issuer and the server. The token is considered valid if the current time is
+before `exp` + `jwt_expiry_leeway`.
+
+---
+
+### jwt_audience _<table class="undef">_
+Default: (none)
+
+If specified, the token's `aud` claim must match one of the values in this table to be considered
+valid.
+
+[rfc7628]: https://tools.ietf.org/html/rfc7628
+[rfc6750]: https://tools.ietf.org/html/rfc6750
+[rfc7662]: https://tools.ietf.org/html/rfc7662
diff --git a/docs/reference/auth/tls.md b/docs/reference/auth/tls.md
new file mode 100644
index 000000000..04610e78e
--- /dev/null
+++ b/docs/reference/auth/tls.md
@@ -0,0 +1,76 @@
+# TLS certificate authentication
+
+`auth.tls` module implements TLS client certificate authentication for the server. It should be
+used only if the server is correctly configured to use TLS while requiring client certificates.
+If TLS is not used or client certificate is not provided by the client, `auth.tls` will
+fail. Though it is possible to use classic username-password authentication as a fallback
+by specifying multiple providers using `auth` directive multiple times.
+
+Example:
+```
+smtp ... {
+ tls {
+ ...
+ client_auth verify_if_given
+ client_ca /path/to/ca.pem
+ }
+ auth tls
+ auth pass_table ... # fallback for clients that do not support TLS client authentication
+
+ ...
+}
+```
+
+## Configuration directives
+
+```
+auth.tls {
+ identity_fields san_email cn
+ ignore_requested_identity no
+ identity_normalize auto
+ require_key_usage yes
+ require_ext_key_usage yes
+}
+```
+
+### identity_fields _field..._
+Default: `san_email cn`
+
+List of certificate fields to use when extracting client identity.
+
+Valid values are: `san_email`, `cn`. SAN fields will use corresponding
+fields of Subject Alternative Name extension, while `cn` will use Common Name field of
+the certificate. PKCS#9 emailAddress field (commonly displayed as EMAILADDRESS or E in subject)
+is obsolete and is not supported, SAN email field should be used instead.
+
+If multiple fields are specified, they will be tried in specified order until a non-empty
+value is found. If no non-empty value is found, authentication will fail.
+
+### ignore_requested_identity _yes&#124;no_
+Default: `no`
+
+If set to `yes`, the server will ignore the identity requested by the client and will
+always use the first non-empty value from `identity_fields` as the client identity. If set to
+`no`, the server will use the identity requested by the client if it is present in the certificate
+and is non-empty.
+
+Most clients do not support SASL authorization identity and therefore cannot
+request a specific identity to be used.
+
+### identity_normalize _func_
+Default: `auto`
+
+Function used to normalize the extracted identity and requested identity. See
+[Global configuration](../global-config) for details on available functions.
+
+### require_key_usage _yes&#124;no_
+Default: `yes`
+
+If set to `yes`, the server will require that the certificate has Key Usage extension with
+Digital Signature bit set.
+
+### require_ext_key_usage _yes&#124;no_
+Default: `yes`
+
+If set to `yes`, the server will require that the certificate has Extended Key Usage extension
+with Client Authentication bit set.
diff --git a/docs/reference/blob/fs.md b/docs/reference/blob/fs.md
index ef94b54b4..c05e3e008 100644
--- a/docs/reference/blob/fs.md
+++ b/docs/reference/blob/fs.md
@@ -2,17 +2,29 @@
 
 This module stores message bodies in a file system directory.
 
+Module does not escape path separators so "a/b" will be stored in "a" subdirectory
+that must exist already. ".." is allowed as long as it does not escape the
+configured root directory.
+
+Module supports both `storage.blob` and `table` interfaces and can be used
+as a metadata store this way.
+
+## Configuration directives
+
+```
+storage.blob.fs <directory>
+table.fs <directory>
+```
+
 ```
 storage.blob.fs {
 root <directory>
 }
-```
 
+table.fs {
+ root <directory>
+}
 ```
-storage.blob.fs <directory>
-```
-
-## Configuration directives
 
 ### root _path_
 Default: not set
diff --git a/docs/reference/blob/s3.md b/docs/reference/blob/s3.md
index 54b6a4e2f..7b68f322e 100644
--- a/docs/reference/blob/s3.md
+++ b/docs/reference/blob/s3.md
@@ -2,6 +2,9 @@
 
 storage.blob.s3 module stores messages bodies in a bucket on S3-compatible storage.
 
+Module supports both `storage.blob` and `table` interfaces and can be used
+as a metadata store this way.
+
 ```
 storage.blob.s3 {
 endpoint play.min.io
@@ -90,7 +93,7 @@ Credentials to use for accessing the S3 Bucket.
 
 Credential Types:
 
- - `access_key`: use AWS access key and secret access key 
+ - `access_key`: use AWS access key and secret access key
 - `file_minio`: use credentials for Minio present at ~/.mc/config.json
 - `file_aws`: use credentials for AWS S3 present at ~/.aws/credentials
 - `iam`: use AWS IAM instance profile for credentials.
diff --git a/docs/reference/tls.md b/docs/reference/tls.md
index 954b0e066..eb26774fd 100644
--- a/docs/reference/tls.md
+++ b/docs/reference/tls.md
@@ -21,6 +21,8 @@ tls {
 	protocols tls1.2 tls1.3
 	curves X25519
 	ciphers ...
+	client_auth none
+	client_ca ...
 }
 ```
 
@@ -30,7 +32,7 @@ tls {
 E.g. `tls file certA.pem keyA.pem certB.pem keyB.pem`.
 If multiple certificates are listed, SNI will be used.
 - `acme` – Automatically obtains a certificate using ACME protocol (Let's Encrypt)
-- `off` – Not really a loader but a special value for tls directive, 
+- `off` – Not really a loader but a special value for tls directive,
 explicitly disables TLS for endpoint(s).
 
 ## Advanced TLS configuration
@@ -49,7 +51,7 @@ Valid values are: `tls1.0`, `tls1.1`, `tls1.2`, `tls1.3`
 
 ---
 
-### ciphers _ciphers..._ 
+### ciphers _ciphers..._
 Default: Go version-defined set of 'secure ciphers', ordered by hardware
 performance
 
@@ -90,6 +92,29 @@ order.
 
 Valid values: `p256`, `p384`, `p521`, `X25519`.
 
+### client_auth _mode_
+Default: `none`
+
+Client authentication mode. If set to `require`, client must present a valid certificate
+signed by one of the CAs specified in `client_ca` directive. If set to `verify_if_given`,
+client may present a certificate, but it is not required.
+
+Valid values: `none`, `request`, `require_any`, `verify_if_given`, `require`
+
+Note that only `require` and `verify_if_given` modes actually verify client certificates. `auth.tls` will
+work only with these two modes, so if you want to use client certificate authentication, you should choose
+one of them.
+
+TLS client authentication is not widely supported by email clients, so `require` mode should be used only
+if you are sure that all your clients support it and are configured to use it. `verify_if_given` mode is a
+good choice if you want to allow client authentication for clients that support it, but do not want to break
+compatibility with clients that do not support it.
+
+### client_ca _paths..._
+Default: none
+
+List of files with PEM-encoded CA certificates to use when verifying client certificates.
+
 ## Client
 
 `tls_client` directive allows to customize behavior of TLS client implementation,
diff --git a/docs/tutorials/building-from-source.md b/docs/tutorials/building-from-source.md
index 55b6852e2..99cf68614 100644
--- a/docs/tutorials/building-from-source.md
+++ b/docs/tutorials/building-from-source.md
@@ -6,7 +6,7 @@ You need C toolchain, Go toolchain and Make:
 
 On Debian-based system this should work:
 ```
-apt-get install golang-1.23 gcc libc6-dev make
+apt-get install golang-1.25 gcc libc6-dev make
 ```
 
 Additionally, if you want manual pages, you should also have scdoc installed.
@@ -23,8 +23,8 @@ toolchain to build maddy. It is necessary to run commands below only
 if you have `go` command version older than 1.21.
 
 ```
-wget "https://go.dev/dl/go1.23.5.linux-amd64.tar.gz"
-tar xf "go1.23.5.linux-amd64.tar.gz"
+wget "https://go.dev/dl/go1.25.10linux-amd64.tar.gz"
+tar xf "go1.25.10.linux-amd64.tar.gz"
 export GOROOT="$PWD/go"
 export PATH="$PWD/go/bin:$PATH"
 ```
@@ -39,7 +39,7 @@ $ cd maddy
 
 2. Select the appropriate version to build:
 ```
-$ git checkout v0.8.0 # a specific release
+$ git checkout v0.9.4 # a specific release
 $ git checkout master # next bugfix release
 $ git checkout dev # next feature release
 ```
diff --git a/framework/config/config.go b/framework/config/config.go
index 3dd9911b6..cbef06452 100644
--- a/framework/config/config.go
+++ b/framework/config/config.go
@@ -21,7 +21,7 @@ package config
 import (
 	"fmt"
 
-	parser "github.com/foxcpp/maddy/framework/cfgparser"
+	"github.com/foxcpp/maddy/framework/config/parser"
 )
 
 type (
diff --git a/framework/config/module/modconfig.go b/framework/config/module/modconfig.go
index 2b4eab6cc..0ca6d2b81 100644
--- a/framework/config/module/modconfig.go
+++ b/framework/config/module/modconfig.go
@@ -31,8 +31,8 @@ import (
 	"reflect"
 	"strings"
 
-	parser "github.com/foxcpp/maddy/framework/cfgparser"
 	"github.com/foxcpp/maddy/framework/config"
+	"github.com/foxcpp/maddy/framework/config/parser"
 	"github.com/foxcpp/maddy/framework/container"
 	"github.com/foxcpp/maddy/framework/log"
 	"github.com/foxcpp/maddy/framework/module"
diff --git a/framework/cfgparser/env.go b/framework/config/parser/env.go
similarity index 100%
rename from framework/cfgparser/env.go
rename to framework/config/parser/env.go
diff --git a/framework/cfgparser/imports.go b/framework/config/parser/imports.go
similarity index 100%
rename from framework/cfgparser/imports.go
rename to framework/config/parser/imports.go
diff --git a/framework/cfgparser/parse.go b/framework/config/parser/parse.go
similarity index 100%
rename from framework/cfgparser/parse.go
rename to framework/config/parser/parse.go
diff --git a/framework/cfgparser/parse_test.go b/framework/config/parser/parse_test.go
similarity index 100%
rename from framework/cfgparser/parse_test.go
rename to framework/config/parser/parse_test.go
diff --git a/framework/config/tls/server.go b/framework/config/tls/server.go
index 4fe8e8d31..3532007e1 100644
--- a/framework/config/tls/server.go
+++ b/framework/config/tls/server.go
@@ -20,6 +20,9 @@ package tls
 
 import (
 	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"os"
 
 	"github.com/foxcpp/maddy/framework/config"
 	modconfig "github.com/foxcpp/maddy/framework/config/module"
@@ -27,6 +30,14 @@ import (
 	"github.com/foxcpp/maddy/framework/module"
 )
 
+var clientAuthMap = map[string]tls.ClientAuthType{
+	"none": tls.NoClientCert,
+	"request": tls.RequestClientCert,
+	"require_any": tls.RequireAnyClientCert,
+	"verify_if_given": tls.VerifyClientCertIfGiven,
+	"require": tls.RequireAndVerifyClientCert,
+}
+
 type TLSConfig struct {
 	loader module.TLSLoader
 	baseCfg *tls.Config
@@ -74,6 +85,8 @@ func readTLSBlock(globals map[string]interface{}, blockNode config.Node) (*TLSCo
 		SessionTicketsDisabled: true,
 	}
 
+	var clientCAPaths []string
+
 	var loader module.TLSLoader
 	if len(blockNode.Args)> 0 {
 		if blockNode.Args[0] == "off" {
@@ -109,10 +122,31 @@ func readTLSBlock(globals map[string]interface{}, blockNode config.Node) (*TLSCo
 		return nil, nil
 	}, TLSCurvesDirective, &baseCfg.CurvePreferences)
 
+	config.EnumMapped[tls.ClientAuthType](
+		childM, "client_auth", false, false,
+		clientAuthMap, tls.NoClientCert, &baseCfg.ClientAuth,
+	)
+
+	childM.StringList("client_ca", false, false, nil, &clientCAPaths)
+
 	if _, err := childM.Process(); err != nil {
 		return nil, err
 	}
 
+	if len(clientCAPaths)> 0 {
+		pool := x509.NewCertPool()
+		for _, path := range clientCAPaths {
+			blob, err := os.ReadFile(path)
+			if err != nil {
+				return nil, err
+			}
+			if !pool.AppendCertsFromPEM(blob) {
+				return nil, fmt.Errorf("no certificates was loaded from %s", path)
+			}
+		}
+		baseCfg.ClientCAs = pool
+	}
+
 	baseCfg.MinVersion = tlsVersions[0]
 	baseCfg.MaxVersion = tlsVersions[1]
 	log.Debugf("tls: min version: %x, max version: %x", tlsVersions[0], tlsVersions[1])
diff --git a/framework/module/auth.go b/framework/module/auth.go
index 6e8d08945..14e79e423 100644
--- a/framework/module/auth.go
+++ b/framework/module/auth.go
@@ -18,19 +18,65 @@ along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 package module
 
-import "errors"
+import (
+	"crypto/tls"
+	"errors"
+	"net"
+)
 
 // ErrUnknownCredentials should be returned by auth. provider if supplied
 // credentials are valid for it but are not recognized (e.g. not found in
 // used DB).
 var ErrUnknownCredentials = errors.New("unknown credentials")
 
+type ProxiedTLSContext struct {
+	ValidCert bool
+	CertUsername string
+	Cipher string
+	CipherBits int
+	PFS string
+	Version uint16
+}
+
+type AuthContext struct {
+	Service string
+	LocalAddr net.Addr
+	RemoteAddr net.Addr
+	TLS *tls.ConnectionState
+	ProxiedTLS *ProxiedTLSContext // populated instead of TLS if TLS is terminated by upstream and TLS info is available
+}
+
+type BearerTokenError struct {
+	Err error
+	Status string
+	Schemes string // probably, "bearer"
+	Scope string
+	OIDCConfigURL string
+}
+
+func (e BearerTokenError) Error() string { return e.Err.Error() }
+func (e BearerTokenError) Unwrap() error { return e.Err }
+
+// SASLAuth is an authentication module that dynamically defines
+// supported mechanisms.
+type SASLAuth interface {
+	SASLMechanisms() []string
+}
+
+type BearerTokenAuth interface {
+	AuthBearerToken(ctx *AuthContext, username, token string) (identity string, err error)
+}
+
+type ExternalAuth interface {
+	AuthExternal(ctx *AuthContext, requestedIdentity string) (finalIdentity string, err error)
+}
+
 // PlainAuth is the interface implemented by modules providing authentication using
 // username:password pairs.
 //
 // Modules implementing this interface should be registered with "auth." prefix in name.
 type PlainAuth interface {
-	AuthPlain(username, password string) error
+	AuthPlain(ctx *AuthContext, username, password string) error
 }
 
 // PlainUserDB is a local credentials store that can be managed using maddy command
diff --git a/framework/module/modules/dummy.go b/framework/module/modules/dummy.go
index 7d2051d17..5ee41a445 100644
--- a/framework/module/modules/dummy.go
+++ b/framework/module/modules/dummy.go
@@ -36,7 +36,7 @@ import (
 // and the actual server code (but the latter is kinda pointless).
 type Dummy struct{ instName string }
 
-func (d *Dummy) AuthPlain(username, _ string) error {
+func (d *Dummy) AuthPlain(ctx *module.AuthContext, username, password string) error {
 	return nil
 }
 
diff --git a/go.mod b/go.mod
index d3d6e9971..ad85df182 100644
--- a/go.mod
+++ b/go.mod
@@ -1,8 +1,6 @@
 module github.com/foxcpp/maddy
 
-go 1.23.1
-
-toolchain go1.23.5
+go 1.25
 
 require (
 	blitiri.com.ar/go/spf v1.5.1
@@ -17,7 +15,7 @@ require (
 	github.com/emersion/go-msgauth v0.6.8
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6
 	github.com/emersion/go-smtp v0.21.3
-	github.com/foxcpp/go-dovecot-sasl v0.0.0-20260303144336-f7632c6ec0ba
+	github.com/foxcpp/go-dovecot-sasl v0.0.0-20260511123641-a448d7c72dc6
 	github.com/foxcpp/go-imap-backend-tests v0.0.0-20220105184719-e80aa29a5e16
 	github.com/foxcpp/go-imap-i18nlevel v0.0.0-20200208001533-d6ec88553005
 	github.com/foxcpp/go-imap-mess v0.0.0-20230108134257-b7ec3a649613
@@ -27,8 +25,11 @@ require (
 	github.com/foxcpp/go-mtasts v0.0.0-20240130093538-1438da2e5932
 	github.com/go-ldap/ldap/v3 v3.4.10
 	github.com/go-sql-driver/mysql v1.8.1
+	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/uuid v1.6.0
 	github.com/hashicorp/go-hclog v1.6.3
+	github.com/hashicorp/golang-lru/v2 v2.0.7
+	github.com/jimlambrt/gldap v0.1.14
 	github.com/johannesboyne/gofakes3 v0.0.0-20210704111953-6a9f95c2941c
 	github.com/lib/pq v1.10.9
 	github.com/libdns/acmedns v0.2.0
@@ -107,7 +108,6 @@ require (
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/jimlambrt/gldap v0.1.14 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/klauspost/compress v1.17.11 // indirect
diff --git a/go.sum b/go.sum
index e5bf2edba..24f0b2f1d 100644
--- a/go.sum
+++ b/go.sum
@@ -237,6 +237,8 @@ github.com/caddyserver/certmagic v0.21.7 h1:66KJioPFJwttL43KYSWk7ErSmE6LfaJgCQuh
 github.com/caddyserver/certmagic v0.21.7/go.mod h1:LCPG3WLxcnjVKl/xpjzM0gqh0knrKKKiO5WVttX2eEI=
 github.com/caddyserver/zerossl v0.1.3 h1:onS+pxp3M8HnHpN5MMbOMyNjmTheJyWRaZYwn+YTAyA=
 github.com/caddyserver/zerossl v0.1.3/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
+github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
+github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -304,10 +306,8 @@ github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/foxcpp/go-dovecot-sasl v0.0.0-20200522223722-c4699d7a24bf h1:rmBPY5fryjp9zLQYsUmQqqgsYq7qeVfrjtr96Tf9vD8=
-github.com/foxcpp/go-dovecot-sasl v0.0.0-20200522223722-c4699d7a24bf/go.mod h1:5yZUmwr851vgjyAfN7OEfnrmKOh/qLA5dbGelXYsu1E=
-github.com/foxcpp/go-dovecot-sasl v0.0.0-20260303144336-f7632c6ec0ba h1:yxQhqX9RQCvECZKBtqwCZoKy/6CLaozDZeWH9Lvndy0=
-github.com/foxcpp/go-dovecot-sasl v0.0.0-20260303144336-f7632c6ec0ba/go.mod h1:5yZUmwr851vgjyAfN7OEfnrmKOh/qLA5dbGelXYsu1E=
+github.com/foxcpp/go-dovecot-sasl v0.0.0-20260511123641-a448d7c72dc6 h1:urtEnd//IMEws/prECei6cmUJiynEkUs5q6flZ0Py4g=
+github.com/foxcpp/go-dovecot-sasl v0.0.0-20260511123641-a448d7c72dc6/go.mod h1:5yZUmwr851vgjyAfN7OEfnrmKOh/qLA5dbGelXYsu1E=
 github.com/foxcpp/go-imap v1.0.0-beta.1.0.20220623182312-df940c324887 h1:qUoaaHyrRpQw85ru6VQcC6JowdhrWl7lSbI1zRX1FTM=
 github.com/foxcpp/go-imap v1.0.0-beta.1.0.20220623182312-df940c324887/go.mod h1:Qlx1FSx2FTxjnjWpIlVNEuX+ylerZQNFE5NsmKFSejY=
 github.com/foxcpp/go-imap-backend-tests v0.0.0-20220105184719-e80aa29a5e16 h1:qheFPDpteiUy7Ym18R68OYenpk85UyKYGkhYTmddSBg=
@@ -318,10 +318,6 @@ github.com/foxcpp/go-imap-mess v0.0.0-20230108134257-b7ec3a649613 h1:fw9OWfPxP1C
 github.com/foxcpp/go-imap-mess v0.0.0-20230108134257-b7ec3a649613/go.mod h1:P/O/qz4gaVkefzJ40BUtN/ZzBnaEg0YYe1no/SMp7Aw=
 github.com/foxcpp/go-imap-namespace v0.0.0-20200802091432-08496dd8e0ed h1:1Jo7geyvunrPSjL6F6D9EcXoNApS5v3LQaro7aUNPnE=
 github.com/foxcpp/go-imap-namespace v0.0.0-20200802091432-08496dd8e0ed/go.mod h1:Shows1vmkBWO40ChOClaUe6DUnZrsP1UPAuoWzIUdgQ=
-github.com/foxcpp/go-imap-sql v0.5.1-0.20250124140007-8da5567429d5 h1:jMxhw9qmwqg70qfMDWq0ImRHAduQjkTZOC9vBs5t2ug=
-github.com/foxcpp/go-imap-sql v0.5.1-0.20250124140007-8da5567429d5/go.mod h1:LMlfyNkVs7v2zE6OVeGe9qWPmKFdXDmLNddPLodPVIw=
-github.com/foxcpp/go-imap-sql v0.5.1-0.20260412133145-20097edd35ec h1:Jm71K60qrrnyISeLXMYKzSZe0RVco+aO/RJugJvafIM=
-github.com/foxcpp/go-imap-sql v0.5.1-0.20260412133145-20097edd35ec/go.mod h1:LMlfyNkVs7v2zE6OVeGe9qWPmKFdXDmLNddPLodPVIw=
 github.com/foxcpp/go-imap-sql v0.5.1-0.20260412184517-b5e85e90f14d h1:oiq5MLSSqd3sl4VNHKTlrwszWTHIx8+x8y/olInMJRo=
 github.com/foxcpp/go-imap-sql v0.5.1-0.20260412184517-b5e85e90f14d/go.mod h1:LMlfyNkVs7v2zE6OVeGe9qWPmKFdXDmLNddPLodPVIw=
 github.com/foxcpp/go-mockdns v0.0.0-20191216195825-5eabd8dbfe1f/go.mod h1:tPg4cp4nseejPd+UKxtCVQ2hUxNTZ7qQZJa7CLriIeo=
@@ -358,6 +354,8 @@ github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpv
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
 github.com/goccy/go-json v0.10.4 h1:JSwxQzIqKfmFX1swYPpUThQZp/Ka4wzJdK0LWVytLPM=
 github.com/goccy/go-json v0.10.4/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -476,6 +474,8 @@ github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/C
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
diff --git a/internal/auth/dovecot_sasl/dovecot_sasl.go b/internal/auth/dovecot_sasl/dovecot_sasl.go
index 9b30f9248..3166c7ce7 100644
--- a/internal/auth/dovecot_sasl/dovecot_sasl.go
+++ b/internal/auth/dovecot_sasl/dovecot_sasl.go
@@ -19,6 +19,8 @@ along with this program. If not, see <https://www.gnu.org/licenses/>.
 package dovecotsasl
 
 import (
+	"crypto/tls"
+	"crypto/x509"
 	"fmt"
 	"net"
 
@@ -136,7 +138,102 @@ func (a *Auth) Configure(inlineArgs []string, cfg *config.Map) error {
 	return nil
 }
 
-func (a *Auth) AuthPlain(username, password string) error {
+func (a *Auth) certUsername(cert *x509.Certificate) string {
+	if len(cert.EmailAddresses)> 0 {
+		return cert.EmailAddresses[0]
+	}
+	if cert.Subject.CommonName != "" {
+		return cert.Subject.CommonName
+	}
+	return ""
+}
+
+func (a *Auth) dovecotParams(ctx *module.AuthContext) []dovecotsasl.Parameter {
+	var result []dovecotsasl.Parameter
+	result = append(result, dovecotsasl.ParamNoPenalty)
+
+	if ctx.RemoteAddr != nil {
+		tcpAddr, ok := ctx.RemoteAddr.(*net.TCPAddr)
+		if ok {
+			result = append(
+				result,
+				dovecotsasl.ParamRemoteIP(tcpAddr.IP),
+				dovecotsasl.ParamRemotePort(uint16(tcpAddr.Port)),
+			)
+		}
+	}
+	if ctx.LocalAddr != nil {
+		tcpAddr, ok := ctx.LocalAddr.(*net.TCPAddr)
+		if ok {
+			result = append(
+				result,
+				dovecotsasl.ParamLocalIP(tcpAddr.IP),
+				dovecotsasl.ParamLocalPort(uint16(tcpAddr.Port)),
+			)
+		}
+	}
+	if ctx.TLS != nil && ctx.TLS.HandshakeComplete {
+		result = append(
+			result,
+			dovecotsasl.ParamSecured(dovecotsasl.SecuredTLS),
+			dovecotsasl.ParamTransport(dovecotsasl.TransportTLS),
+			dovecotsasl.ParamTLSCipher(tls.CipherSuiteName(ctx.TLS.CipherSuite)),
+			dovecotsasl.ParamTLSProtocol(ctx.TLS.Version),
+		)
+		if len(ctx.TLS.VerifiedChains)> 0 && ctx.TLS.VerifiedChains[0] != nil {
+			result = append(
+				result,
+				dovecotsasl.ParamValidClientCert,
+			)
+			username := a.certUsername(ctx.TLS.VerifiedChains[0][0])
+			if username != "" {
+				result = append(
+					result,
+					dovecotsasl.Parameter("cert_username="+username),
+				)
+			}
+		}
+	}
+	if ctx.ProxiedTLS != nil {
+		result = append(
+			result,
+			dovecotsasl.ParamSecured(dovecotsasl.SecuredTLS),
+			dovecotsasl.ParamTransport(dovecotsasl.TransportTLS),
+		)
+		if ctx.ProxiedTLS.Cipher != "" {
+			result = append(result, dovecotsasl.ParamTLSCipher(ctx.ProxiedTLS.Cipher))
+		}
+		if ctx.ProxiedTLS.Version != 0 {
+			result = append(result, dovecotsasl.ParamTLSProtocol(ctx.ProxiedTLS.Version))
+		}
+		if ctx.ProxiedTLS.PFS != "" {
+			result = append(result, dovecotsasl.ParamTLSPFS(ctx.ProxiedTLS.PFS))
+		}
+		if ctx.ProxiedTLS.CipherBits != 0 {
+			result = append(result, dovecotsasl.ParamTLSCipherBits(ctx.ProxiedTLS.CipherBits))
+		}
+		if ctx.ProxiedTLS.CertUsername != "" {
+			result = append(result, dovecotsasl.Parameter("cert_username="+ctx.ProxiedTLS.CertUsername))
+		}
+	}
+
+	return result
+}
+
+func (a *Auth) SASLMechanisms() []string {
+	list := make([]string, 0, len(a.mechanisms))
+	for mech := range a.mechanisms {
+		list = append(list, mech)
+	}
+	return list
+}
+
+func (a *Auth) AuthPlain(ctx *module.AuthContext, username, password string) error {
+	service := "SMTP"
+	if ctx.Service != "" {
+		service = ctx.Service
+	}
+
 	if _, ok := a.mechanisms[sasl.Plain]; ok {
 		cl, err := a.getConn()
 		if err != nil {
@@ -144,10 +241,8 @@ func (a *Auth) AuthPlain(username, password string) error {
 		}
 		defer a.returnConn(cl)
 
-		// Pretend it is SMTPS even though we really don't know.
-		// We also have no connection information to pass to the server...
-		return cl.Do("SMTP", sasl.NewPlainClient("", username, password),
-			dovecotsasl.Secured, dovecotsasl.NoPenalty)
+		return cl.Do(service, sasl.NewPlainClient("", username, password),
+			a.dovecotParams(ctx)...)
 	}
 	if _, ok := a.mechanisms[sasl.Login]; ok {
 		cl, err := a.getConn()
@@ -156,8 +251,8 @@ func (a *Auth) AuthPlain(username, password string) error {
 		}
 		defer a.returnConn(cl)
 
-		return cl.Do("SMTP", sasl.NewLoginClient(username, password),
-			dovecotsasl.Secured, dovecotsasl.NoPenalty)
+		return cl.Do(service, sasl.NewLoginClient(username, password),
+			a.dovecotParams(ctx)...)
 	}
 
 	return auth.ErrUnsupportedMech
diff --git a/internal/auth/external/externalauth.go b/internal/auth/external/externalauth.go
index 1d3f4ae31..5a75f9fe4 100644
--- a/internal/auth/external/externalauth.go
+++ b/internal/auth/external/externalauth.go
@@ -91,7 +91,7 @@ func (ea *ExternalAuth) Configure(inlineArgs []string, cfg *config.Map) error {
 	return nil
 }
 
-func (ea *ExternalAuth) AuthPlain(username, password string) error {
+func (ea *ExternalAuth) AuthPlain(ctx *module.AuthContext, username, password string) error {
 	accountName, ok := auth.CheckDomainAuth(username, ea.perDomain, ea.domains)
 	if !ok {
 		return module.ErrUnknownCredentials
diff --git a/internal/auth/ldap/ldap.go b/internal/auth/ldap/ldap.go
index af8c63045..e0d50125f 100644
--- a/internal/auth/ldap/ldap.go
+++ b/internal/auth/ldap/ldap.go
@@ -245,7 +245,7 @@ func (a *Auth) Lookup(_ context.Context, username string) (string, bool, error)
 	return userDN, true, nil
 }
 
-func (a *Auth) AuthPlain(username, password string) error {
+func (a *Auth) AuthPlain(ctx *module.AuthContext, username, password string) error {
 	conn, err := a.getConn()
 	if err != nil {
 		return err
diff --git a/internal/auth/netauth/netauth.go b/internal/auth/netauth/netauth.go
index ce6715e66..c4a9f6646 100644
--- a/internal/auth/netauth/netauth.go
+++ b/internal/auth/netauth/netauth.go
@@ -91,7 +91,7 @@ func (a *Auth) Lookup(ctx context.Context, username string) (string, bool, error
 
 // AuthPlain attempts straightforward authentication of the entity on
 // the remote NetAuth server.
-func (a *Auth) AuthPlain(username, password string) error {
+func (a *Auth) AuthPlain(ctx *module.AuthContext, username, password string) error {
 	a.log.Debugf("attempting to auth user: %s", username)
 	if err := a.nacl.AuthEntity(context.Background(), username, password); err != nil {
 		return module.ErrUnknownCredentials
diff --git a/internal/auth/oauth/oauth.go b/internal/auth/oauth/oauth.go
new file mode 100644
index 000000000..2e7d50341
--- /dev/null
+++ b/internal/auth/oauth/oauth.go
@@ -0,0 +1,512 @@
+package oauth
+
+import (
+	"context"
+	"crypto/tls"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/foxcpp/maddy/framework/config"
+	modconfig "github.com/foxcpp/maddy/framework/config/module"
+	tls2 "github.com/foxcpp/maddy/framework/config/tls"
+	"github.com/foxcpp/maddy/framework/container"
+	"github.com/foxcpp/maddy/framework/log"
+	"github.com/foxcpp/maddy/framework/module"
+	"github.com/foxcpp/maddy/framework/module/modules"
+	"github.com/golang-jwt/jwt/v5"
+	lru "github.com/hashicorp/golang-lru/v2"
+)
+
+const modName = "auth.oauth"
+
+type IntrospectionMethod func(mod *OAuth, ctx context.Context, token string) (map[string]interface{}, error)
+
+type Config struct {
+	TLSClient *tls.Config
+	AdditionalHTTPHeaders http.Header
+	Introspection IntrospectionMethod
+	IntrospectionURL string
+	IntrospectionTimeout time.Duration
+	Scopes []string
+	UsernameAttribute string
+	ActiveAttribute string
+	ActiveValue string
+
+	JWTKeyIDTemplate string
+	JWTKeyTable module.Table
+	JWTValidMethods []string
+	JWTIssuers []string
+	JWTExpiryLeeway time.Duration
+	JWTAudienceTable module.Table
+	OIDCDiscoveryURL string
+}
+
+type OAuth struct {
+	log *log.Logger
+	instName string
+	cfg Config
+	client *http.Client
+
+	keyCache *lru.TwoQueueCache[string, any]
+}
+
+func New(c *container.C, modName, instName string) (module.Module, error) {
+	keyCache, err := lru.New2Q[string, any](20)
+	if err != nil {
+		return nil, err
+	}
+	return &OAuth{
+		log: c.DefaultLogger.Sublogger(modName),
+		instName: instName,
+		keyCache: keyCache,
+	}, nil
+}
+
+func (o *OAuth) Name() string {
+	return modName
+}
+
+func (o *OAuth) InstanceName() string {
+	return o.instName
+}
+
+func (o *OAuth) Configure(inlineArgs []string, cfg *config.Map) error {
+	switch len(inlineArgs) {
+	case 0:
+	case 1:
+		o.cfg.IntrospectionURL = inlineArgs[0]
+	default:
+		return errors.New("too many arguments")
+	}
+
+	introspectionMethods := map[string]IntrospectionMethod{
+		"auth": (*OAuth).IntrospectAuth,
+		"get": (*OAuth).IntrospectGet,
+		"post": (*OAuth).IntrospectPost,
+		"local": (*OAuth).IntrospectLocal,
+	}
+
+	cfg.Custom("tls_client", true, false, func() (interface{}, error) {
+		return &tls.Config{}, nil
+	}, tls2.TLSClientBlock, &o.cfg.TLSClient)
+	cfg.Callback("http_header", func(m *config.Map, node config.Node) error {
+		if len(node.Args) != 2 {
+			return errors.New("http_header requires two arguments")
+		}
+		key := node.Args[0]
+		value := node.Args[1]
+		if o.cfg.AdditionalHTTPHeaders == nil {
+			o.cfg.AdditionalHTTPHeaders = http.Header{}
+		}
+		o.cfg.AdditionalHTTPHeaders.Add(key, value)
+		return nil
+	})
+	config.EnumMapped(cfg, "introspection", false, false,
+		introspectionMethods, (*OAuth).IntrospectAuth, &o.cfg.Introspection)
+	cfg.String("introspection_url", false, false,
+		"", &o.cfg.IntrospectionURL)
+	cfg.Duration("introspection_timeout", false, false,
+		5*time.Second, &o.cfg.IntrospectionTimeout)
+	cfg.StringList("scopes", false, false, nil, &o.cfg.Scopes)
+	cfg.String("username_attribute", false, false, "email", &o.cfg.UsernameAttribute)
+	cfg.String("active_attribute", false, false, "", &o.cfg.ActiveAttribute)
+	cfg.String("active_value", false, false, "", &o.cfg.ActiveValue)
+	cfg.String("jwt_key_id_template", false, false, "{kid_url}", &o.cfg.JWTKeyIDTemplate)
+	cfg.Custom("jwt_key_table", false, false, func() (interface{}, error) {
+		return nil, nil
+	}, modconfig.TableDirective, &o.cfg.JWTKeyTable)
+	cfg.StringList("jwt_valid_methods", false, false, []string{
+		"HS256", "HS384", "HS512",
+		"RS256", "RS384", "RS512",
+		"ES256", "ES384", "ES512",
+		"PS256", "PS384", "PS512",
+		"EdDSA",
+	}, &o.cfg.JWTValidMethods)
+	cfg.StringList("jwt_issuers", false, false, nil, &o.cfg.JWTIssuers)
+	cfg.Duration("jwt_expiry_leeway", false, false, 30*time.Second, &o.cfg.JWTExpiryLeeway)
+	cfg.Custom("jwt_audience", false, false, func() (interface{}, error) {
+		return nil, nil
+	}, modconfig.TableDirective, &o.cfg.JWTAudienceTable)
+
+	if _, err := cfg.Process(); err != nil {
+		return err
+	}
+
+	o.client = &http.Client{
+		Transport: &http.Transport{
+			TLSClientConfig: o.cfg.TLSClient,
+		},
+		Timeout: o.cfg.IntrospectionTimeout,
+	}
+
+	return nil
+}
+
+func (o *OAuth) AuthBearerToken(authCtx *module.AuthContext, username, token string) (string, error) {
+	attributes, err := o.cfg.Introspection(o, context.TODO(), token)
+	if err != nil {
+		return "", fmt.Errorf("auth.oauth: token introspection failed: %w", err)
+	}
+	if attributes == nil {
+		return "", fmt.Errorf("auth.oauth: token introspection returned no attributes")
+	}
+
+	o.log.DebugMsg("token attributes", "attributes", attributes)
+
+	if !o.isActive(attributes) {
+		return "", fmt.Errorf("auth.oauth: account is disabled")
+	}
+
+	if err := o.validateScope(attributes); err != nil {
+		return "", err
+	}
+
+	username, ok := o.getUsername(attributes, username)
+	if !ok {
+		return "", fmt.Errorf("auth.oauth: no username found")
+	}
+
+	return username, nil
+}
+
+func (o *OAuth) IntrospectAuth(ctx context.Context, token string) (map[string]interface{}, error) {
+	req, err := http.NewRequestWithContext(ctx, "GET", o.cfg.IntrospectionURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create introspection request: %w", err)
+	}
+	req.Header.Set("Authorization", "Bearer "+token)
+
+	return o.introspectHTTP(ctx, req)
+}
+
+func (o *OAuth) IntrospectGet(ctx context.Context, token string) (map[string]interface{}, error) {
+	introspectURL := o.cfg.IntrospectionURL
+	if strings.Contains(introspectURL, "?") {
+		introspectURL += url.QueryEscape(token)
+	} else {
+		introspectURL += url.PathEscape(token)
+	}
+
+	req, err := http.NewRequest("GET", introspectURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create introspection request: %w", err)
+	}
+
+	return o.introspectHTTP(ctx, req)
+}
+
+func (o *OAuth) IntrospectPost(ctx context.Context, token string) (map[string]interface{}, error) {
+	form := url.Values{}
+	form.Set("token", token)
+	req, err := http.NewRequest("POST", o.cfg.IntrospectionURL, strings.NewReader(form.Encode()))
+	if err != nil {
+		return nil, fmt.Errorf("create introspection request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	return o.introspectHTTP(ctx, req)
+}
+
+func (o *OAuth) introspectHTTP(ctx context.Context, req *http.Request) (map[string]interface{}, error) {
+	for k, v := range o.cfg.AdditionalHTTPHeaders {
+		req.Header[k] = append(req.Header[k], v...)
+	}
+
+	resp, err := o.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("do: %w", err)
+	}
+	defer func(Body io.ReadCloser) {
+		err := Body.Close()
+		if err != nil {
+			o.log.Error("failed to close response body", err)
+		}
+	}(resp.Body)
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("http: %s", resp.Status)
+	}
+	if !strings.HasPrefix(resp.Header.Get("Content-Type"), "application/json") {
+		return nil, fmt.Errorf("content-type is not application/json")
+	}
+
+	var attributes map[string]interface{}
+	if err := json.NewDecoder(resp.Body).Decode(&attributes); err != nil {
+		return nil, fmt.Errorf("decode response json: %w", err)
+	}
+
+	return attributes, nil
+}
+
+func (o *OAuth) IntrospectLocal(ctx context.Context, token string) (map[string]interface{}, error) {
+	opts := []jwt.ParserOption{
+		jwt.WithValidMethods(o.cfg.JWTValidMethods),
+		jwt.WithLeeway(o.cfg.JWTExpiryLeeway),
+	}
+
+	parsedToken, err := jwt.ParseWithClaims(
+		token, jwt.MapClaims{}, o.getJWTKey,
+		opts...,
+	)
+	if err != nil {
+		return nil, module.BearerTokenError{
+			Err: fmt.Errorf("jwt: %w", err),
+			Status: "invalid_token",
+			OIDCConfigURL: o.cfg.OIDCDiscoveryURL,
+		}
+	}
+
+	claims, ok := parsedToken.Claims.(jwt.MapClaims)
+	if !ok {
+		panic("unexpected claims type")
+	}
+
+	if len(o.cfg.JWTIssuers) != 0 {
+		iss, err := claims.GetIssuer()
+		if err != nil {
+			return nil, fmt.Errorf("get issuer: %w", err)
+		}
+		if iss == "" {
+			return nil, module.BearerTokenError{
+				Err: fmt.Errorf("auth.oauth: jwt iss is required"),
+				Status: "invalid_token",
+				OIDCConfigURL: o.cfg.OIDCDiscoveryURL,
+			}
+		}
+		var ok bool
+		for _, validIss := range o.cfg.JWTIssuers {
+			if strings.EqualFold(validIss, iss) {
+				ok = true
+				break
+			}
+		}
+		if !ok {
+			return nil, module.BearerTokenError{
+				Err: fmt.Errorf("auth.oauth: jwt issuer '%s' is invalid", iss),
+				Status: "invalid_token",
+				OIDCConfigURL: o.cfg.OIDCDiscoveryURL,
+			}
+		}
+	}
+
+	if o.cfg.JWTAudienceTable != nil {
+		audClaim, err := claims.GetAudience()
+		if err != nil &#124;&#124; len(audClaim) == 0 {
+			return nil, module.BearerTokenError{
+				Err: fmt.Errorf("auth.oauth: jwt audience claim is required but missing or invalid"),
+				Status: "invalid_token",
+				OIDCConfigURL: o.cfg.OIDCDiscoveryURL,
+			}
+		}
+		for _, aud := range audClaim {
+			_, ok, err := o.cfg.JWTAudienceTable.Lookup(ctx, aud)
+			if err != nil {
+				return nil, fmt.Errorf("auth.oauth: jwt audience table error: %w", err)
+			}
+			if !ok {
+				return nil, module.BearerTokenError{
+					Err: fmt.Errorf("auth.oauth: jwt audience '%s' is invalid", aud),
+					Status: "invalid_token",
+					OIDCConfigURL: o.cfg.OIDCDiscoveryURL,
+				}
+			}
+		}
+	}
+
+	return claims, nil
+}
+
+func (o *OAuth) getJWTKey(token *jwt.Token) (any, error) {
+	keyID := o.getKeyID(token)
+	if keyID == "" {
+		return nil, fmt.Errorf("malformed token: no key ID found")
+	}
+
+	cachedKey, ok := o.keyCache.Get(keyID)
+	if ok {
+		return cachedKey, nil
+	}
+
+	keyText, ok, err := o.cfg.JWTKeyTable.Lookup(context.TODO(), keyID)
+	if err != nil {
+		return nil, fmt.Errorf("lookup JWT key as %s: %w", keyID, err)
+	}
+	if !ok {
+		return nil, fmt.Errorf("no matching JWT key found for %s", keyID)
+	}
+
+	var key any
+
+	switch token.Method {
+	case jwt.SigningMethodHS256, jwt.SigningMethodHS384, jwt.SigningMethodHS512:
+		key = []byte(keyText)
+	case jwt.SigningMethodES256, jwt.SigningMethodES384, jwt.SigningMethodES512:
+		key, err = jwt.ParseECPublicKeyFromPEM([]byte(keyText))
+	case jwt.SigningMethodPS256, jwt.SigningMethodPS384, jwt.SigningMethodPS512:
+		fallthrough
+	case jwt.SigningMethodRS256, jwt.SigningMethodRS384, jwt.SigningMethodRS512:
+		key, err = jwt.ParseRSAPublicKeyFromPEM([]byte(keyText))
+	case jwt.SigningMethodEdDSA:
+		key, err = jwt.ParseEdPublicKeyFromPEM([]byte(keyText))
+	default:
+		err = fmt.Errorf("unsupported signing method: %s", token.Method.Alg())
+	}
+	if err != nil {
+		return nil, fmt.Errorf("parse JWT key: %w", err)
+	}
+
+	o.keyCache.Add(keyID, key)
+
+	return key, nil
+}
+
+func (o *OAuth) getKeyID(token *jwt.Token) string {
+	if o.cfg.JWTKeyIDTemplate == "" {
+		return token.Header["alg"].(string)
+	}
+
+	kid, ok := token.Header["kid"].(string)
+	if !ok {
+		kid = "default"
+	}
+	alg, ok := token.Header["alg"].(string)
+	if !ok {
+		// alg is required, short-circuit into invalid value if missing
+		return ""
+	}
+	alg = strings.ToUpper(alg)
+
+	var azp string
+	claims, ok := token.Claims.(jwt.MapClaims)
+	if ok {
+		azp, ok = claims["azp"].(string)
+		if !ok {
+			azp = "default"
+		}
+	}
+
+	return strings.NewReplacer(
+		"{alg}", alg,
+		"{kid}", kid,
+		"{kid_url_path}", url.PathEscape(kid),
+		"{azp}", azp,
+	).Replace(o.cfg.JWTKeyIDTemplate)
+}
+
+func (o *OAuth) validateScope(attributes map[string]interface{}) error {
+	if len(o.cfg.Scopes) == 0 {
+		return nil
+	}
+
+	scopeClaim, ok := attributes["scope"].(string)
+	if !ok {
+		return module.BearerTokenError{
+			Err: fmt.Errorf("auth.oauth: scope attribute is required"),
+			Status: "insufficient_scope",
+			Scope: strings.Join(o.cfg.Scopes, " "),
+			OIDCConfigURL: o.cfg.OIDCDiscoveryURL,
+		}
+	}
+	tokenScopes := strings.Fields(scopeClaim)
+	for _, requiredScope := range o.cfg.Scopes {
+		var ok bool
+		for _, tokenScope := range tokenScopes {
+			if tokenScope == requiredScope {
+				ok = true
+				break
+			}
+		}
+		if !ok {
+			return module.BearerTokenError{
+				Err: fmt.Errorf("auth.oauth: scope %v is insufficient", tokenScopes),
+				Status: "insufficient_scope",
+				Scope: strings.Join(o.cfg.Scopes, " "),
+				OIDCConfigURL: o.cfg.OIDCDiscoveryURL,
+			}
+		}
+	}
+
+	return nil
+}
+
+func (o *OAuth) getUsername(attributes map[string]interface{}, requestedUsername string) (string, bool) {
+	usernameList, ok := attributes[o.cfg.UsernameAttribute].([]string)
+	if ok {
+		if requestedUsername == "" {
+			return usernameList[0], true
+		}
+		for _, username := range usernameList {
+			if username == requestedUsername {
+				return username, true
+			}
+		}
+		return "", false
+	}
+
+	username, ok := attributes[o.cfg.UsernameAttribute].(string)
+	if !ok {
+		return "", false
+	}
+
+	if requestedUsername == "" {
+		return username, true
+	}
+
+	return username, username == requestedUsername
+}
+
+func (o *OAuth) isActive(attributes map[string]interface{}) bool {
+	if o.cfg.ActiveAttribute == "" {
+		return true
+	}
+	attrValue, ok := attributes[o.cfg.ActiveAttribute]
+	if !ok {
+		return false
+	}
+
+	if o.cfg.ActiveValue == "" {
+		switch attrVal := attrValue.(type) {
+		case string:
+			return attrVal != ""
+		case bool:
+			return attrVal
+		case float64:
+			return attrVal != 0
+		default:
+			return false
+		}
+	}
+
+	switch attrVal := attrValue.(type) {
+	case string:
+		return attrVal == o.cfg.ActiveValue
+	case bool:
+		if strings.EqualFold(o.cfg.ActiveValue, "true") {
+			return attrVal
+		} else if strings.EqualFold(o.cfg.ActiveValue, "false") {
+			return !attrVal
+		}
+		return false
+	case float64:
+		activeFloat, err := strconv.ParseFloat(o.cfg.ActiveValue, 64)
+		if err != nil {
+			return false
+		}
+		return attrVal == activeFloat
+	default:
+		return false
+	}
+}
+
+func init() {
+	var _ module.BearerTokenAuth = &OAuth{}
+
+	modules.Register(modName, New)
+}
diff --git a/internal/auth/oauth/oauth_test.go b/internal/auth/oauth/oauth_test.go
new file mode 100644
index 000000000..68e740428
--- /dev/null
+++ b/internal/auth/oauth/oauth_test.go
@@ -0,0 +1,392 @@
+package oauth
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/foxcpp/maddy/framework/module"
+	"github.com/foxcpp/maddy/internal/testutils"
+	"github.com/golang-jwt/jwt/v5"
+	lru "github.com/hashicorp/golang-lru/v2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func testModule(t *testing.T, client *http.Client, cfg Config) *OAuth {
+	cache, err := lru.New2Q[string, any](5)
+	require.NoError(t, err)
+
+	return &OAuth{
+		log: testutils.Logger(t, "auth.oauth"),
+		instName: "test_auth",
+		cfg: cfg,
+		client: client,
+		keyCache: cache,
+	}
+}
+
+func TestOAuthIntrospectAuth(t *testing.T) {
+	var introspectionResult map[string]any
+	var introspectionStatusCode int
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodGet, r.Method)
+		assert.Equal(t, "/introspect", r.URL.String())
+		assert.Equal(t, "Bearer testtoken", r.Header.Get("Authorization"))
+		assert.Equal(t, "test-indeed", r.Header.Get("X-Test"))
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(introspectionStatusCode)
+
+		err := json.NewEncoder(w).Encode(introspectionResult)
+		assert.NoError(t, err)
+	}))
+	t.Cleanup(srv.Close)
+
+	o := testModule(t, srv.Client(), Config{
+		TLSClient: nil,
+		AdditionalHTTPHeaders: map[string][]string{
+			"X-Test": {"test-indeed"},
+		},
+		Introspection: (*OAuth).IntrospectAuth,
+		IntrospectionURL: srv.URL + "/introspect",
+		IntrospectionTimeout: 10 * time.Second,
+		Scopes: []string{"email", "offline_access"},
+		UsernameAttribute: "email",
+		ActiveAttribute: "active",
+		ActiveValue: "true",
+	})
+
+	t.Run("ok", func(t *testing.T) {
+		introspectionResult = map[string]any{
+			"active": true,
+			"email": "testuser@maddy.test",
+			"scope": "email offline_access",
+		}
+		introspectionStatusCode = http.StatusOK
+
+		username, err := o.AuthBearerToken(&module.AuthContext{}, "", "testtoken")
+		require.NoError(t, err)
+		assert.Equal(t, "testuser@maddy.test", username)
+	})
+	t.Run("inactive", func(t *testing.T) {
+		introspectionResult = map[string]any{
+			"active": false,
+			"email": "testuser@maddy.test",
+			"scope": "email offline_access",
+		}
+		introspectionStatusCode = http.StatusOK
+
+		_, err := o.AuthBearerToken(&module.AuthContext{}, "", "testtoken")
+		require.Error(t, err)
+	})
+	t.Run("no activity", func(t *testing.T) {
+		introspectionResult = map[string]any{
+			"email": "testuser@maddy.test",
+			"scope": "email offline_access",
+		}
+		introspectionStatusCode = http.StatusOK
+
+		_, err := o.AuthBearerToken(&module.AuthContext{}, "", "testtoken")
+		require.Error(t, err)
+	})
+	t.Run("broken activity value", func(t *testing.T) {
+		introspectionResult = map[string]any{
+			"active": "whatever",
+			"email": "testuser@maddy.test",
+			"scope": "email offline_access",
+		}
+		introspectionStatusCode = http.StatusOK
+
+		_, err := o.AuthBearerToken(&module.AuthContext{}, "", "testtoken")
+		require.Error(t, err)
+	})
+	t.Run("introspection error", func(t *testing.T) {
+		introspectionResult = map[string]any{}
+		introspectionStatusCode = http.StatusInternalServerError
+
+		_, err := o.AuthBearerToken(&module.AuthContext{}, "", "testtoken")
+		require.Error(t, err)
+	})
+	t.Run("no username", func(t *testing.T) {
+		introspectionResult = map[string]any{
+			"active": true,
+			"scope": "email offline_access",
+		}
+		introspectionStatusCode = http.StatusOK
+
+		_, err := o.AuthBearerToken(&module.AuthContext{}, "", "testtoken")
+		require.Error(t, err)
+	})
+}
+
+func TestOAuthIntrospectGet(t *testing.T) {
+	var introspectionResult map[string]any
+	var introspectionStatusCode int
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodGet, r.Method)
+		assert.Equal(t, "/introspect?token=testtoken", r.URL.String())
+		assert.Equal(t, "test-indeed", r.Header.Get("X-Test"))
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(introspectionStatusCode)
+
+		err := json.NewEncoder(w).Encode(introspectionResult)
+		assert.NoError(t, err)
+	}))
+	t.Cleanup(srv.Close)
+
+	introspectionResult = map[string]any{
+		"active": true,
+		"scope": "email offline_access",
+		"email": "testuser@maddy.test",
+	}
+	introspectionStatusCode = http.StatusOK
+
+	o := testModule(t, srv.Client(), Config{
+		TLSClient: nil,
+		AdditionalHTTPHeaders: map[string][]string{
+			"X-Test": {"test-indeed"},
+		},
+		Introspection: (*OAuth).IntrospectGet,
+		IntrospectionURL: srv.URL + "/introspect?token=",
+		IntrospectionTimeout: 10 * time.Second,
+		Scopes: []string{"email", "offline_access"},
+		UsernameAttribute: "email",
+		ActiveAttribute: "active",
+		ActiveValue: "true",
+	})
+
+	username, err := o.AuthBearerToken(&module.AuthContext{}, "", "testtoken")
+	require.NoError(t, err)
+	assert.Equal(t, "testuser@maddy.test", username)
+}
+
+func TestOAuthIntrospectPost(t *testing.T) {
+	var introspectionResult map[string]any
+	var introspectionStatusCode int
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodPost, r.Method)
+		assert.Equal(t, "/introspect", r.URL.String())
+		assert.Equal(t, "test-indeed", r.Header.Get("X-Test"))
+		assert.Equal(t, "application/x-www-form-urlencoded", r.Header.Get("Content-Type"))
+
+		assert.NoError(t, r.ParseForm())
+		assert.Equal(t, "testtoken", r.Form.Get("token"))
+
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(introspectionStatusCode)
+
+		err := json.NewEncoder(w).Encode(introspectionResult)
+		assert.NoError(t, err)
+	}))
+	t.Cleanup(srv.Close)
+
+	introspectionResult = map[string]any{
+		"active": true,
+		"scope": "email offline_access",
+		"email": "testuser@maddy.test",
+	}
+	introspectionStatusCode = http.StatusOK
+
+	o := testModule(t, srv.Client(), Config{
+		TLSClient: nil,
+		AdditionalHTTPHeaders: map[string][]string{
+			"X-Test": {"test-indeed"},
+		},
+		Introspection: (*OAuth).IntrospectPost,
+		IntrospectionURL: srv.URL + "/introspect",
+		IntrospectionTimeout: 10 * time.Second,
+		Scopes: []string{"email", "offline_access"},
+		UsernameAttribute: "email",
+		ActiveAttribute: "active",
+		ActiveValue: "true",
+	})
+
+	username, err := o.AuthBearerToken(&module.AuthContext{}, "", "testtoken")
+	require.NoError(t, err)
+	assert.Equal(t, "testuser@maddy.test", username)
+}
+
+func TestOAuthIntrospectLocal(t *testing.T) {
+	pubKey, privateKey, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	pubKeyBlob, err := x509.MarshalPKIXPublicKey(pubKey)
+	require.NoError(t, err)
+	pubKeyPEM := pem.EncodeToMemory(&pem.Block{
+		Type: "PUBLIC KEY",
+		Bytes: pubKeyBlob,
+	})
+
+	keyTable := testutils.Table{
+		M: map[string]string{
+			"default/EDDSA/default": string(pubKeyPEM),
+			"azp_value/EDDSA/default": string(pubKeyPEM),
+			"azp_value/EDDSA/kid_value": string(pubKeyPEM),
+		},
+	}
+
+	o := testModule(t, nil, Config{
+		TLSClient: nil,
+		AdditionalHTTPHeaders: nil,
+		Introspection: (*OAuth).IntrospectLocal,
+		IntrospectionURL: "",
+		IntrospectionTimeout: 10 * time.Second,
+		Scopes: []string{"email", "offline_access"},
+		UsernameAttribute: "email",
+		ActiveAttribute: "active",
+		ActiveValue: "true",
+		JWTKeyIDTemplate: "{azp}/{alg}/{kid}",
+		JWTExpiryLeeway: time.Second,
+		JWTKeyTable: keyTable,
+		JWTValidMethods: []string{jwt.SigningMethodEdDSA.Alg()},
+		JWTIssuers: []string{"valid_issuer"},
+		JWTAudienceTable: testutils.Table{
+			M: map[string]string{
+				"valid_aud": "",
+			},
+		},
+	})
+
+	createToken := func(hdr map[string]any, attributes jwt.MapClaims) string {
+		tok := jwt.New(jwt.SigningMethodEdDSA)
+		tok.Claims = attributes
+		for k, v := range hdr {
+			tok.Header[k] = v
+		}
+		attributes["exp"] = time.Now().Add(time.Hour).Unix()
+		token, err := tok.SignedString(privateKey)
+		require.NoError(t, err)
+		return token
+	}
+
+	t.Run("ok", func(t *testing.T) {
+		token := createToken(map[string]any{
+			"kid": "kid_value",
+		}, jwt.MapClaims{
+			"azp": "azp_value",
+			"active": true,
+			"iss": "valid_issuer",
+			"aud": "valid_aud",
+			"scope": "email offline_access",
+			"email": "testuser@maddy.test",
+		})
+
+		username, err := o.AuthBearerToken(&module.AuthContext{}, "", token)
+		require.NoError(t, err)
+		assert.Equal(t, "testuser@maddy.test", username)
+	})
+
+	t.Run("default kid", func(t *testing.T) {
+		token := createToken(map[string]any{}, jwt.MapClaims{
+			"azp": "azp_value",
+			"active": true,
+			"iss": "valid_issuer",
+			"aud": "valid_aud",
+			"scope": "email offline_access",
+			"email": "testuser@maddy.test",
+		})
+
+		username, err := o.AuthBearerToken(&module.AuthContext{}, "", token)
+		require.NoError(t, err)
+		assert.Equal(t, "testuser@maddy.test", username)
+	})
+
+	t.Run("default azp", func(t *testing.T) {
+		token := createToken(map[string]any{}, jwt.MapClaims{
+			"active": true,
+			"iss": "valid_issuer",
+			"aud": "valid_aud",
+			"scope": "email offline_access",
+			"email": "testuser@maddy.test",
+		})
+
+		username, err := o.AuthBearerToken(&module.AuthContext{}, "", token)
+		require.NoError(t, err)
+		assert.Equal(t, "testuser@maddy.test", username)
+	})
+
+	t.Run("missing issuer", func(t *testing.T) {
+		token := createToken(map[string]any{}, jwt.MapClaims{
+			"active": true,
+			"aud": "valid_aud",
+			"scope": "email offline_access",
+			"email": "testuser@maddy.test",
+		})
+
+		_, err := o.AuthBearerToken(&module.AuthContext{}, "", token)
+		require.Error(t, err)
+	})
+
+	t.Run("invalid issuer", func(t *testing.T) {
+		token := createToken(map[string]any{}, jwt.MapClaims{
+			"active": true,
+			"iss": "invalid_issuer",
+			"aud": "valid_aud",
+			"scope": "email offline_access",
+			"email": "testuser@maddy.test",
+		})
+
+		_, err := o.AuthBearerToken(&module.AuthContext{}, "", token)
+		require.Error(t, err)
+	})
+
+	t.Run("invalid aud", func(t *testing.T) {
+		token := createToken(map[string]any{}, jwt.MapClaims{
+			"active": true,
+			"iss": "valid_issuer",
+			"aud": "invalid_aud",
+			"scope": "email offline_access",
+			"email": "testuser@maddy.test",
+		})
+
+		_, err := o.AuthBearerToken(&module.AuthContext{}, "", token)
+		require.Error(t, err)
+	})
+
+	t.Run("wrong key", func(t *testing.T) {
+		_, privateKey, err := ed25519.GenerateKey(rand.Reader)
+		require.NoError(t, err)
+
+		tok := jwt.New(jwt.SigningMethodEdDSA)
+		claims := jwt.MapClaims{
+			"active": true,
+			"iss": "valid_issuer",
+			"aud": "invalid_aud",
+			"scope": "email offline_access",
+			"email": "testuser@maddy.test",
+		}
+		claims["exp"] = time.Now().Add(time.Hour).Unix()
+		tok.Claims = claims
+		token, err := tok.SignedString(privateKey)
+		require.NoError(t, err)
+
+		_, err = o.AuthBearerToken(&module.AuthContext{}, "", token)
+		require.Error(t, err)
+	})
+
+	t.Run("expired token", func(t *testing.T) {
+		tok := jwt.New(jwt.SigningMethodEdDSA)
+		claims := jwt.MapClaims{
+			"active": true,
+			"iss": "valid_issuer",
+			"aud": "invalid_aud",
+			"scope": "email offline_access",
+			"email": "testuser@maddy.test",
+		}
+		claims["exp"] = time.Now().Add(-2 * time.Second).Unix()
+		tok.Claims = claims
+		token, err := tok.SignedString(privateKey)
+		require.NoError(t, err)
+
+		_, err = o.AuthBearerToken(&module.AuthContext{}, "", token)
+		require.Error(t, err)
+	})
+}
diff --git a/internal/auth/pam/module.go b/internal/auth/pam/module.go
index 12977a52f..619cbad32 100644
--- a/internal/auth/pam/module.go
+++ b/internal/auth/pam/module.go
@@ -79,7 +79,7 @@ func (a *Auth) Configure(inlineArgs []string, cfg *config.Map) error {
 	return nil
 }
 
-func (a *Auth) AuthPlain(username, password string) error {
+func (a *Auth) AuthPlain(ctx *module.AuthContext, username, password string) error {
 	if a.useHelper {
 		if err := external.AuthUsingHelper(a.helperPath, username, password); err != nil {
 			return err
diff --git a/internal/auth/pass_table/table.go b/internal/auth/pass_table/table.go
index 8d3cea34e..8bf53e918 100644
--- a/internal/auth/pass_table/table.go
+++ b/internal/auth/pass_table/table.go
@@ -73,7 +73,7 @@ func (a *Auth) Lookup(ctx context.Context, username string) (string, bool, error
 	return a.table.Lookup(ctx, key)
 }
 
-func (a *Auth) AuthPlain(username, password string) error {
+func (a *Auth) AuthPlain(ctx *module.AuthContext, username, password string) error {
 	key, err := precis.UsernameCaseMapped.CompareKey(username)
 	if err != nil {
 		return err
diff --git a/internal/auth/pass_table/table_test.go b/internal/auth/pass_table/table_test.go
index 7c8cf6149..42bfa4903 100644
--- a/internal/auth/pass_table/table_test.go
+++ b/internal/auth/pass_table/table_test.go
@@ -23,6 +23,7 @@ import (
 
 	"github.com/foxcpp/maddy/framework/config"
 	"github.com/foxcpp/maddy/framework/container"
+	"github.com/foxcpp/maddy/framework/module"
 	"github.com/foxcpp/maddy/internal/testutils"
 )
 
@@ -51,7 +52,7 @@ func TestAuth_AuthPlain(t *testing.T) {
 	check := func(user, pass string, ok bool) {
 		t.Helper()
 
-		err := a.AuthPlain(user, pass)
+		err := a.AuthPlain(&module.AuthContext{}, user, pass)
 		if (err == nil) != ok {
 			t.Errorf("ok=%v, err: %v", ok, err)
 		}
diff --git a/internal/auth/plain_separate/plain_separate.go b/internal/auth/plain_separate/plain_separate.go
index ae4371437..ab0117ddf 100644
--- a/internal/auth/plain_separate/plain_separate.go
+++ b/internal/auth/plain_separate/plain_separate.go
@@ -114,7 +114,7 @@ func (a *Auth) Lookup(ctx context.Context, username string) (string, bool, error
 	return "", true, nil
 }
 
-func (a *Auth) AuthPlain(username, password string) error {
+func (a *Auth) AuthPlain(ctx *module.AuthContext, username, password string) error {
 	ok := len(a.userTbls) == 0
 	for _, tbl := range a.userTbls {
 		_, tblOk, err := tbl.Lookup(context.TODO(), username)
@@ -132,7 +132,7 @@ func (a *Auth) AuthPlain(username, password string) error {
 
 	var lastErr error
 	for _, p := range a.passwd {
-		if err := p.AuthPlain(username, password); err != nil {
+		if err := p.AuthPlain(ctx, username, password); err != nil {
 			lastErr = err
 			continue
 		}
diff --git a/internal/auth/plain_separate/plain_separate_test.go b/internal/auth/plain_separate/plain_separate_test.go
index e5365cc70..303f2a328 100644
--- a/internal/auth/plain_separate/plain_separate_test.go
+++ b/internal/auth/plain_separate/plain_separate_test.go
@@ -35,7 +35,7 @@ func (mockAuth) SASLMechanisms() []string {
 	return []string{sasl.Plain, sasl.Login}
 }
 
-func (m mockAuth) AuthPlain(username, _ string) error {
+func (m mockAuth) AuthPlain(ctx *module.AuthContext, username, password string) error {
 	ok := m.db[username]
 	if !ok {
 		return errors.New("invalid creds")
@@ -63,7 +63,7 @@ func TestPlainSplit_NoUser(t *testing.T) {
 		},
 	}
 
-	err := a.AuthPlain("user1", "aaa")
+	err := a.AuthPlain(&module.AuthContext{}, "user1", "aaa")
 	if err != nil {
 		t.Fatal("Unexpected error:", err)
 	}
@@ -85,7 +85,7 @@ func TestPlainSplit_NoUser_MultiPass(t *testing.T) {
 		},
 	}
 
-	err := a.AuthPlain("user1", "aaa")
+	err := a.AuthPlain(&module.AuthContext{}, "user1", "aaa")
 	if err != nil {
 		t.Fatal("Unexpected error:", err)
 	}
@@ -114,7 +114,7 @@ func TestPlainSplit_UserPass(t *testing.T) {
 		},
 	}
 
-	err := a.AuthPlain("user1", "aaa")
+	err := a.AuthPlain(&module.AuthContext{}, "user1", "aaa")
 	if err != nil {
 		t.Fatal("Unexpected error:", err)
 	}
@@ -148,7 +148,7 @@ func TestPlainSplit_MultiUser_Pass(t *testing.T) {
 		},
 	}
 
-	err := a.AuthPlain("user1", "aaa")
+	err := a.AuthPlain(&module.AuthContext{}, "user1", "aaa")
 	if err != nil {
 		t.Fatal("Unexpected error:", err)
 	}
diff --git a/internal/auth/sasl.go b/internal/auth/sasl.go
index 591e37647..8dc281dc9 100644
--- a/internal/auth/sasl.go
+++ b/internal/auth/sasl.go
@@ -22,7 +22,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"net"
 
 	"github.com/emersion/go-sasl"
 	"github.com/foxcpp/maddy/framework/config"
@@ -56,12 +55,22 @@ type SASLAuth struct {
 
 	ErrorMap func(err error) error
 
-	Plain []module.PlainAuth
+	BearerToken []module.BearerTokenAuth
+	External []module.ExternalAuth
+	Plain []module.PlainAuth
 }
 
 func (s *SASLAuth) SASLMechanisms() []string {
 	var mechs []string
 
+	if len(s.BearerToken) != 0 {
+		mechs = append(mechs, sasl.OAuthBearer)
+	}
+
+	if len(s.External) != 0 {
+		mechs = append(mechs, sasl.External)
+	}
+
 	if len(s.Plain) != 0 {
 		mechs = append(mechs, sasl.Plain)
 		if s.EnableLogin {
@@ -100,7 +109,45 @@ func (s *SASLAuth) usernameForAuth(ctx context.Context, saslUsername string) (st
 	return mapped, nil
 }
 
-func (s *SASLAuth) AuthPlain(username, password string) error {
+func (s *SASLAuth) AuthBearerToken(ctx *SASLContext, username, token string) (string, error) {
+	if len(s.BearerToken) == 0 {
+		return "", ErrUnsupportedMech
+	}
+
+	var lastErr error
+	for _, e := range s.BearerToken {
+		s.Log.DebugMsg("attempting authentication", "module", e)
+
+		var finalUsername string
+		finalUsername, lastErr = e.AuthBearerToken((*module.AuthContext)(ctx), username, token)
+		if lastErr == nil {
+			return finalUsername, nil
+		}
+	}
+
+	return "", fmt.Errorf("no auth. provider succeeded, last err: %w", lastErr)
+}
+
+func (s *SASLAuth) AuthExternal(ctx *SASLContext, identity string) (string, error) {
+	if len(s.External) == 0 {
+		return "", ErrUnsupportedMech
+	}
+
+	var lastErr error
+	for _, e := range s.External {
+		s.Log.DebugMsg("attempting authentication", "module", e)
+
+		var finalIdentity string
+		finalIdentity, lastErr = e.AuthExternal((*module.AuthContext)(ctx), identity)
+		if lastErr == nil {
+			return finalIdentity, nil
+		}
+	}
+
+	return "", fmt.Errorf("no auth. provider succeeded, last err: %w", lastErr)
+}
+
+func (s *SASLAuth) AuthPlain(ctx *module.AuthContext, username, password string) error {
 	if len(s.Plain) == 0 {
 		return ErrUnsupportedMech
 	}
@@ -116,7 +163,7 @@ func (s *SASLAuth) AuthPlain(username, password string) error {
 			"mapped_username", mappedUsername, "original_username", username,
 			"module", p)
 
-		lastErr = p.AuthPlain(mappedUsername, password)
+		lastErr = p.AuthPlain(ctx, mappedUsername, password)
 		if lastErr == nil {
 			return nil
 		}
@@ -125,6 +172,8 @@ func (s *SASLAuth) AuthPlain(username, password string) error {
 	return fmt.Errorf("no auth. provider accepted creds, last err: %w", lastErr)
 }
 
+type SASLContext module.AuthContext
+
 type ContextData struct {
 	// Authentication username. May be different from identity.
 	Username string
@@ -135,10 +184,47 @@ type ContextData struct {
 
 // CreateSASL creates the sasl.Server instance for the corresponding mechanism.
 func (s *SASLAuth) CreateSASL(
-	mech string, remoteAddr net.Addr,
+	mech string, ctx *SASLContext,
 	successCb func(identity string, data ContextData) error,
 ) sasl.Server {
 	switch mech {
+	case sasl.OAuthBearer:
+		return sasl.NewOAuthBearerServer(func(opts sasl.OAuthBearerOptions) *sasl.OAuthBearerError {
+			username, err := s.AuthBearerToken(ctx, opts.Username, opts.Token)
+			if err != nil {
+				var oauthErr *module.BearerTokenError
+				if errors.As(err, &oauthErr) {
+					return &sasl.OAuthBearerError{
+						Status: oauthErr.Status,
+						Schemes: oauthErr.Schemes,
+						Scope: oauthErr.Scope,
+						//OIDCConfigURL: oauthErr.OIDCConfigURL,
+					}
+				}
+				return &sasl.OAuthBearerError{Status: "server_error", Schemes: "bearer"}
+			}
+			cbErr := successCb(username, ContextData{
+				Username: username,
+			})
+			if cbErr != nil {
+				return &sasl.OAuthBearerError{Status: "server_error", Schemes: "bearer"}
+			}
+			return nil
+		})
+	case sasl.External:
+		return sasl.NewExternalServer(func(identity string) error {
+			acceptedIdentity, err := s.AuthExternal(ctx, identity)
+			if err != nil {
+				s.Log.Error("authentication failed", err, "src_ip", ctx.RemoteAddr)
+				if s.ErrorMap != nil {
+					return s.ErrorMap(ErrInvalidAuthCred)
+				}
+				return ErrInvalidAuthCred
+			}
+			return successCb(acceptedIdentity, ContextData{
+				Username: acceptedIdentity,
+			})
+		})
 	case sasl.Plain:
 		return sasl.NewPlainServer(func(identity, username, password string) error {
 			if identity == "" {
@@ -151,9 +237,9 @@ func (s *SASLAuth) CreateSASL(
 				return ErrInvalidAuthCred
 			}
 
-			err := s.AuthPlain(username, password)
+			err := s.AuthPlain((*module.AuthContext)(ctx), username, password)
 			if err != nil {
-				s.Log.Error("authentication failed", err, "username", username, "src_ip", remoteAddr)
+				s.Log.Error("authentication failed", err, "username", username, "src_ip", ctx.RemoteAddr)
 				if s.ErrorMap != nil {
 					return s.ErrorMap(ErrInvalidAuthCred)
 				}
@@ -179,9 +265,9 @@ func (s *SASLAuth) CreateSASL(
 				return err
 			}
 
-			err = s.AuthPlain(username, password)
+			err = s.AuthPlain((*module.AuthContext)(ctx), username, password)
 			if err != nil {
-				s.Log.Error("authentication failed", err, "username", username, "src_ip", remoteAddr)
+				s.Log.Error("authentication failed", err, "username", username, "src_ip", ctx.RemoteAddr)
 				if s.ErrorMap != nil {
 					return s.ErrorMap(ErrInvalidAuthCred)
 				}
@@ -205,11 +291,32 @@ func (s *SASLAuth) AddProvider(m *config.Map, node config.Node) error {
 		return err
 	}
 
+	var saslMechsMap map[string]bool
+
+	saslAuth, ok := any.(module.SASLAuth)
+	if ok {
+		mechsList := saslAuth.SASLMechanisms()
+		saslMechsMap = make(map[string]bool, len(mechsList))
+		for _, mech := range mechsList {
+			saslMechsMap[mech] = true
+		}
+	} else {
+		saslMechsMap = map[string]bool{
+			sasl.OAuthBearer: true,
+			sasl.Plain: true,
+			sasl.External: true,
+		}
+	}
+
 	hasAny := false
-	if plainAuth, ok := any.(module.PlainAuth); ok {
+	if plainAuth, ok := any.(module.PlainAuth); ok && saslMechsMap[sasl.Plain] {
 		s.Plain = append(s.Plain, plainAuth)
 		hasAny = true
 	}
+	if externalAuth, ok := any.(module.ExternalAuth); ok && saslMechsMap[sasl.External] {
+		s.External = append(s.External, externalAuth)
+		hasAny = true
+	}
 
 	if !hasAny {
 		return config.NodeErr(node, "auth: specified module does not provide any SASL mechanism")
diff --git a/internal/auth/sasl_test.go b/internal/auth/sasl_test.go
index a59cfc791..b8ad60265 100644
--- a/internal/auth/sasl_test.go
+++ b/internal/auth/sasl_test.go
@@ -20,7 +20,6 @@ package auth
 
 import (
 	"errors"
-	"net"
 	"testing"
 
 	"github.com/foxcpp/maddy/framework/module"
@@ -31,7 +30,7 @@ type mockAuth struct {
 	db map[string]bool
 }
 
-func (m mockAuth) AuthPlain(username, _ string) error {
+func (m mockAuth) AuthPlain(ctx *module.AuthContext, username, password string) error {
 	ok := m.db[username]
 	if !ok {
 		return errors.New("invalid creds")
@@ -52,7 +51,7 @@ func TestCreateSASL(t *testing.T) {
 	}
 
 	t.Run("XWHATEVER", func(t *testing.T) {
-		srv := a.CreateSASL("XWHATEVER", &net.TCPAddr{}, func(string, ContextData) error { return nil })
+		srv := a.CreateSASL("XWHATEVER", &SASLContext{}, func(string, ContextData) error { return nil })
 		_, _, err := srv.Next([]byte(""))
 		if err == nil {
 			t.Error("No error for XWHATEVER use")
@@ -60,7 +59,7 @@ func TestCreateSASL(t *testing.T) {
 	})
 
 	t.Run("PLAIN", func(t *testing.T) {
-		srv := a.CreateSASL("PLAIN", &net.TCPAddr{}, func(id string, data ContextData) error {
+		srv := a.CreateSASL("PLAIN", &SASLContext{}, func(id string, data ContextData) error {
 			if id != "user1" {
 				t.Fatal("Wrong auth. identities passed to callback:", id)
 			}
@@ -74,7 +73,7 @@ func TestCreateSASL(t *testing.T) {
 	})
 
 	t.Run("PLAIN with authorization identity", func(t *testing.T) {
-		srv := a.CreateSASL("PLAIN", &net.TCPAddr{}, func(id string, data ContextData) error {
+		srv := a.CreateSASL("PLAIN", &SASLContext{}, func(id string, data ContextData) error {
 			if id != "user1" {
 				t.Fatal("Wrong authorization identity passed:", id)
 			}
diff --git a/internal/auth/shadow/module.go b/internal/auth/shadow/module.go
index 8223af28b..8db07fc08 100644
--- a/internal/auth/shadow/module.go
+++ b/internal/auth/shadow/module.go
@@ -110,7 +110,7 @@ func (a *Auth) Lookup(username string) (string, bool, error) {
 	return "", true, nil
 }
 
-func (a *Auth) AuthPlain(username, password string) error {
+func (a *Auth) AuthPlain(ctx *module.AuthContext, username, password string) error {
 	if a.useHelper {
 		return external.AuthUsingHelper(a.helperPath, username, password)
 	}
diff --git a/internal/auth/tls/tls.go b/internal/auth/tls/tls.go
new file mode 100644
index 000000000..1acf27464
--- /dev/null
+++ b/internal/auth/tls/tls.go
@@ -0,0 +1,197 @@
+package tls
+
+import (
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/hex"
+	"errors"
+	"fmt"
+
+	"github.com/foxcpp/maddy/framework/config"
+	"github.com/foxcpp/maddy/framework/container"
+	"github.com/foxcpp/maddy/framework/log"
+	"github.com/foxcpp/maddy/framework/module"
+	"github.com/foxcpp/maddy/framework/module/modules"
+	"github.com/foxcpp/maddy/internal/authz"
+)
+
+const modName = "auth.tls"
+
+type CertIdentityFunc = func(*x509.Certificate) []string
+
+func CertIdentityCN(cert *x509.Certificate) []string {
+	return []string{cert.Subject.CommonName}
+}
+
+func CertIdentitySANEmail(cert *x509.Certificate) []string {
+	return cert.EmailAddresses
+}
+
+var certIdentityFuncs = map[string]CertIdentityFunc{
+	"cn": CertIdentityCN,
+	"san_email": CertIdentitySANEmail,
+}
+
+type Auth struct {
+	log *log.Logger
+	instName string
+
+	identityFuncs []CertIdentityFunc
+	ignoreRequestedIdentity bool
+	identityNormalize authz.NormalizeFunc
+	requireKeyUsage bool
+	requireExtKeyUsage bool
+}
+
+func New(c *container.C, modName, instName string) (module.Module, error) {
+	return &Auth{
+		log: c.DefaultLogger.Sublogger(modName),
+		instName: instName,
+	}, nil
+}
+
+func (a *Auth) Configure(inlineArgs []string, cfg *config.Map) error {
+	if len(inlineArgs)> 0 {
+		return errors.New("inline args not supported")
+	}
+	config.EnumListMapped[CertIdentityFunc](
+		cfg, "identity_fields", false, false,
+		certIdentityFuncs, []CertIdentityFunc{CertIdentitySANEmail, CertIdentityCN},
+		&a.identityFuncs,
+	)
+	cfg.Bool("ignore_requested_identity", false, false, &a.ignoreRequestedIdentity)
+	cfg.Bool("require_key_usage", false, true, &a.requireKeyUsage)
+	cfg.Bool("require_ext_key_usage", false, true, &a.requireExtKeyUsage)
+	config.EnumMapped[authz.NormalizeFunc](
+		cfg, "identity_normalize", false, false,
+		authz.NormalizeFuncs, authz.NormalizeAuto,
+		&a.identityNormalize,
+	)
+	if _, err := cfg.Process(); err != nil {
+		return err
+	}
+
+	if len(a.identityFuncs) == 0 {
+		return errors.New("auth.tls: at least one identity field should be specified")
+	}
+
+	return nil
+}
+
+func (a *Auth) Name() string {
+	return modName
+}
+
+func (a *Auth) InstanceName() string {
+	return a.instName
+}
+
+func (a *Auth) identities(cert *x509.Certificate) []string {
+	result := make([]string, 0, len(a.identityFuncs))
+	for _, identityFunc := range a.identityFuncs {
+		result = append(result, identityFunc(cert)...)
+	}
+	return result
+}
+
+func x509Fingerprint(cert *x509.Certificate) string {
+	hash := sha256.Sum256(cert.Raw)
+	return hex.EncodeToString(hash[:])
+}
+
+func (a *Auth) authenticateProxied(ctx *module.AuthContext, requestedIdentity string) (finalIdentity string, err error) {
+	certUsername, err := a.identityNormalize(ctx.ProxiedTLS.CertUsername)
+	if err != nil {
+		return "", fmt.Errorf("auth.tls: failed to normalize certificate name %q: %w",
+			ctx.ProxiedTLS.CertUsername, err)
+	}
+
+	if requestedIdentity != "" && !a.ignoreRequestedIdentity {
+		if requestedIdentity == certUsername {
+			return certUsername, nil
+		}
+		return "", fmt.Errorf("auth.tls: requested identity does not match certificate username")
+	}
+
+	return certUsername, nil
+}
+
+func (a *Auth) AuthExternal(ctx *module.AuthContext, requestedIdentity string) (finalIdentity string, err error) {
+	if ctx.ProxiedTLS != nil {
+		return a.authenticateProxied(ctx, requestedIdentity)
+	}
+
+	if requestedIdentity != "" {
+		requestedIdentity, err = a.identityNormalize(requestedIdentity)
+		if err != nil {
+			return "", fmt.Errorf("auth.tls: failed to normalize requested identity %q: %w",
+				requestedIdentity, err)
+		}
+	}
+
+	if ctx.TLS == nil &#124;&#124; !ctx.TLS.HandshakeComplete {
+		return "", errors.New("auth.tls: no TLS session to authenticate")
+	}
+	if len(ctx.TLS.PeerCertificates) == 0 {
+		return "", errors.New("auth.tls: no client certificate to authenticate")
+	}
+	if len(ctx.TLS.VerifiedChains) == 0 {
+		return "", errors.New("auth.tls: client certificate is not verified")
+	}
+	if len(ctx.TLS.VerifiedChains[0]) == 0 {
+		return "", errors.New("auth.tls: verified chain is empty")
+	}
+
+	leafCert := ctx.TLS.VerifiedChains[0][0]
+
+	if a.requireKeyUsage && leafCert.KeyUsage&x509.KeyUsageDigitalSignature == 0 {
+		return "", errors.New("auth.tls: key usage digitalSignature is required")
+	}
+	if a.requireExtKeyUsage {
+		var ok bool
+		for _, eku := range leafCert.ExtKeyUsage {
+			if eku == x509.ExtKeyUsageClientAuth {
+				ok = true
+				break
+			}
+		}
+		if !ok {
+			return "", errors.New("auth.tls: no client auth EKU found in certificate")
+		}
+	}
+
+	identities := a.identities(leafCert)
+	if len(identities) == 0 {
+		return "", errors.New("auth.tls: no client identity in provided certificate")
+	}
+
+	if requestedIdentity == "" &#124;&#124; a.ignoreRequestedIdentity {
+		if a.log.IsDebug() {
+			a.log.DebugMsg("accepted client certificate identity",
+				"identity", requestedIdentity, "cert_sha256", x509Fingerprint(leafCert))
+		}
+
+		return identities[0], nil
+	}
+
+	for _, identity := range identities {
+		identity, err = a.identityNormalize(identity)
+		if err != nil {
+			return "", fmt.Errorf("auth.tls: invalid identity %q: %v", identity, err)
+		}
+
+		if identity == requestedIdentity {
+			if a.log.IsDebug() {
+				a.log.DebugMsg("accepted client certificate identity",
+					"identity", requestedIdentity, "cert_sha256", x509Fingerprint(leafCert))
+			}
+
+			return identity, nil
+		}
+	}
+	return "", errors.New("auth.tls: requested identity is not allowed by provided certificate")
+}
+
+func init() {
+	modules.Register("auth.tls", New)
+}
diff --git a/internal/endpoint/dovecot_sasld/dovecot_sasl.go b/internal/endpoint/dovecot_sasld/dovecot_sasl.go
index 215b85082..e0d2f45e9 100644
--- a/internal/endpoint/dovecot_sasld/dovecot_sasl.go
+++ b/internal/endpoint/dovecot_sasld/dovecot_sasl.go
@@ -19,6 +19,7 @@ along with this program. If not, see <https://www.gnu.org/licenses/>.
 package dovecotsasld
 
 import (
+	"crypto/tls"
 	"fmt"
 	stdlog "log"
 	"net"
@@ -31,6 +32,7 @@ import (
 	modconfig "github.com/foxcpp/maddy/framework/config/module"
 	"github.com/foxcpp/maddy/framework/container"
 	"github.com/foxcpp/maddy/framework/log"
+	"github.com/foxcpp/maddy/framework/module"
 	"github.com/foxcpp/maddy/framework/module/modules"
 	"github.com/foxcpp/maddy/framework/resource/netresource"
 	"github.com/foxcpp/maddy/internal/auth"
@@ -69,6 +71,31 @@ func (endp *Endpoint) InstanceName() string {
 	return modName
 }
 
+func proxiedTLSData(req *dovecotsasl.AuthReq) *module.ProxiedTLSContext {
+	var version uint16
+	switch req.TLSProtocol {
+	case "TLSv1.0":
+		version = tls.VersionTLS10
+	case "TLSv1.1":
+		version = tls.VersionTLS11
+	case "TLSv1.2":
+		version = tls.VersionTLS12
+	case "TLSv1.3":
+		version = tls.VersionTLS13
+	default:
+		version = tls.VersionTLS10
+	}
+
+	return &module.ProxiedTLSContext{
+		ValidCert: req.ValidClientCert,
+		CertUsername: req.CertUsername,
+		Cipher: req.TLSCipher,
+		CipherBits: req.TLSCipherBits,
+		PFS: req.TLSPFS,
+		Version: version,
+	}
+}
+
 func (endp *Endpoint) Configure(_ []string, cfg *config.Map) error {
 	cfg.Callback("auth", func(m *config.Map, node config.Node) error {
 		return endp.saslAuth.AddProvider(m, node)
@@ -92,7 +119,23 @@ func (endp *Endpoint) Configure(_ []string, cfg *config.Map) error {
 				remoteAddr = &net.TCPAddr{IP: req.RemoteIP, Port: int(req.RemotePort)}
 			}
 
-			return endp.saslAuth.CreateSASL(mech, remoteAddr, func(_ string, _ auth.ContextData) error { return nil })
+			var localAddr net.Addr
+			if req.LocalIP != nil && req.LocalPort != 0 {
+				localAddr = &net.TCPAddr{IP: req.LocalIP, Port: int(req.LocalPort)}
+			}
+
+			var proxiedTLS *module.ProxiedTLSContext
+			if (req.Secured && req.SecuredMethod == dovecotsasl.SecuredTLS) &#124;&#124;
+				req.Transport == string(dovecotsasl.TransportTLS) {
+				proxiedTLS = proxiedTLSData(req)
+			}
+
+			return endp.saslAuth.CreateSASL(mech, &auth.SASLContext{
+				Service: req.Service,
+				LocalAddr: localAddr,
+				RemoteAddr: remoteAddr,
+				ProxiedTLS: proxiedTLS,
+			}, func(_ string, _ auth.ContextData) error { return nil })
 		})
 	}
 
diff --git a/internal/endpoint/imap/imap.go b/internal/endpoint/imap/imap.go
index afc68a796..87abd88d0 100644
--- a/internal/endpoint/imap/imap.go
+++ b/internal/endpoint/imap/imap.go
@@ -145,7 +145,13 @@ func (endp *Endpoint) Configure(_ []string, cfg *config.Map) error {
 
 	for _, mech := range endp.saslAuth.SASLMechanisms() {
 		endp.serv.EnableAuth(mech, func(c imapserver.Conn) sasl.Server {
-			return endp.saslAuth.CreateSASL(mech, c.Info().RemoteAddr, func(identity string, data auth.ContextData) error {
+			info := c.Info()
+			return endp.saslAuth.CreateSASL(mech, &auth.SASLContext{
+				Service: "IMAP",
+				LocalAddr: info.LocalAddr,
+				RemoteAddr: info.RemoteAddr,
+				TLS: info.TLS,
+			}, func(identity string, data auth.ContextData) error {
 				return endp.openAccount(c, identity)
 			})
 		})
@@ -280,7 +286,12 @@ func (endp *Endpoint) openAccount(c imapserver.Conn, identity string) error {
 
 func (endp *Endpoint) Login(connInfo *imap.ConnInfo, username, password string) (imapbackend.User, error) {
 	// saslAuth handles AuthMap calling.
-	err := endp.saslAuth.AuthPlain(username, password)
+	err := endp.saslAuth.AuthPlain(&module.AuthContext{
+		Service: "IMAP",
+		LocalAddr: connInfo.LocalAddr,
+		RemoteAddr: connInfo.RemoteAddr,
+		TLS: connInfo.TLS,
+	}, username, password)
 	if err != nil {
 		endp.log.Error("authentication failed", err, "username", username, "src_ip", connInfo.RemoteAddr)
 		return nil, imapbackend.ErrInvalidCredentials
diff --git a/internal/endpoint/smtp/session.go b/internal/endpoint/smtp/session.go
index c6adfa0c3..af92b9e39 100644
--- a/internal/endpoint/smtp/session.go
+++ b/internal/endpoint/smtp/session.go
@@ -21,6 +21,7 @@ package smtp
 import (
 	"bufio"
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"io"
@@ -103,7 +104,17 @@ func (s *Session) AuthMechanisms() []string {
 }
 
 func (s *Session) Auth(mech string) (sasl.Server, error) {
-	return s.endp.saslAuth.CreateSASL(mech, s.connState.RemoteAddr, func(identity string, data auth.ContextData) error {
+	var tlsState *tls.ConnectionState
+	if s.connState.TLS.HandshakeComplete {
+		tlsState = &s.connState.TLS
+	}
+
+	return s.endp.saslAuth.CreateSASL(mech, &auth.SASLContext{
+		Service: "SMTP",
+		LocalAddr: s.connState.LocalAddr,
+		RemoteAddr: s.connState.RemoteAddr,
+		TLS: tlsState,
+	}, func(identity string, data auth.ContextData) error {
 		s.connState.AuthUser = identity
 		s.connState.AuthPassword = data.Password
 		return nil
@@ -158,14 +169,14 @@ func (s *Session) cleanSession() {
 	s.msgTask.End()
 }
 
-func (s *Session) AuthPlain(username, password string) error {
+func (s *Session) AuthPlain(ctx *module.AuthContext, username, password string) error {
 	// Executed before authentication and session initialization.
 	if err := s.endp.pipeline.RunEarlyChecks(context.TODO(), &s.connState); err != nil {
 		return s.endp.wrapErr("", true, "AUTH", err)
 	}
 
 	// saslAuth will handle AuthMap and AuthNormalize.
-	err := s.endp.saslAuth.AuthPlain(username, password)
+	err := s.endp.saslAuth.AuthPlain(ctx, username, password)
 	if err != nil {
 		s.endp.log.Error("authentication failed", err, "username", username, "src_ip", s.connState.RemoteAddr)
 
diff --git a/internal/msgpipeline/config_test.go b/internal/msgpipeline/config_test.go
index 24d7e51f8..8fc61060a 100644
--- a/internal/msgpipeline/config_test.go
+++ b/internal/msgpipeline/config_test.go
@@ -23,7 +23,7 @@ import (
 	"strings"
 	"testing"
 
-	parser "github.com/foxcpp/maddy/framework/cfgparser"
+	"github.com/foxcpp/maddy/framework/config/parser"
 	"github.com/foxcpp/maddy/framework/exterrors"
 )
 
diff --git a/internal/storage/blob/fs/fs.go b/internal/storage/blob/fs/fs.go
index 0ef45cd01..d9d01e606 100644
--- a/internal/storage/blob/fs/fs.go
+++ b/internal/storage/blob/fs/fs.go
@@ -9,18 +9,26 @@ import (
 
 	"github.com/foxcpp/maddy/framework/config"
 	"github.com/foxcpp/maddy/framework/container"
+	"github.com/foxcpp/maddy/framework/log"
 	"github.com/foxcpp/maddy/framework/module"
 	"github.com/foxcpp/maddy/framework/module/modules"
 )
 
+const modName = "storage.blob.fs"
+
 // FSStore struct represents directory on FS used to store blobs.
 type FSStore struct {
+	log *log.Logger
 	instName string
-	root string
+	rootPath string
+	root *os.Root
 }
 
-func New(_ *container.C, _, instName string) (module.Module, error) {
-	return &FSStore{instName: instName}, nil
+func New(c *container.C, _, instName string) (module.Module, error) {
+	return &FSStore{
+		log: c.DefaultLogger.Sublogger(modName),
+		instName: instName,
+	}, nil
 }
 
 func (s *FSStore) Name() string {
@@ -35,21 +43,28 @@ func (s *FSStore) Configure(inlineArgs []string, cfg *config.Map) error {
 	switch len(inlineArgs) {
 	case 0:
 	case 1:
-		s.root = inlineArgs[0]
+		s.rootPath = inlineArgs[0]
 	default:
 		return fmt.Errorf("storage.blob.fs: 1 or 0 arguments expected")
 	}
 
-	cfg.String("root", false, false, s.root, &s.root)
+	cfg.String("root", false, false, s.rootPath, &s.rootPath)
 	if _, err := cfg.Process(); err != nil {
 		return err
 	}
 
-	if s.root == "" {
+	if s.rootPath == "" {
 		return config.NodeErr(cfg.Block, "storage.blob.fs: directory not set")
 	}
 
-	if err := os.MkdirAll(s.root, os.ModeDir&#124;os.ModePerm); err != nil {
+	s.rootPath = filepath.Clean(s.rootPath)
+	if err := os.MkdirAll(s.rootPath, os.ModeDir&#124;os.ModePerm); err != nil {
+		return err
+	}
+
+	var err error
+	s.root, err = os.OpenRoot(s.rootPath)
+	if err != nil {
 		return err
 	}
 
@@ -57,7 +72,7 @@ func (s *FSStore) Configure(inlineArgs []string, cfg *config.Map) error {
 }
 
 func (s *FSStore) Open(_ context.Context, key string) (io.ReadCloser, error) {
-	f, err := os.Open(filepath.Join(s.root, key))
+	f, err := s.root.Open(key)
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, module.ErrNoSuchBlob
@@ -68,12 +83,13 @@ func (s *FSStore) Open(_ context.Context, key string) (io.ReadCloser, error) {
 }
 
 func (s *FSStore) Create(_ context.Context, key string, blobSize int64) (module.Blob, error) {
-	f, err := os.Create(filepath.Join(s.root, key))
+	f, err := s.root.Create(key)
 	if err != nil {
 		return nil, err
 	}
 	if blobSize>= 0 {
 		if err := f.Truncate(blobSize); err != nil {
+			_ = f.Close()
 			return nil, err
 		}
 	}
@@ -82,7 +98,7 @@ func (s *FSStore) Create(_ context.Context, key string, blobSize int64) (module.
 
 func (s *FSStore) Delete(_ context.Context, keys []string) error {
 	for _, key := range keys {
-		if err := os.Remove(filepath.Join(s.root, key)); err != nil {
+		if err := s.root.Remove(key); err != nil {
 			if os.IsNotExist(err) {
 				continue
 			}
@@ -92,7 +108,19 @@ func (s *FSStore) Delete(_ context.Context, keys []string) error {
 	return nil
 }
 
+func (s *FSStore) Lookup(_ context.Context, key string) (string, bool, error) {
+	blob, err := s.root.ReadFile(key)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return "", false, nil
+		}
+		return "", false, err
+	}
+	return string(blob), true, nil
+}
+
 func init() {
 	var _ module.BlobStore = &FSStore{}
-	modules.Register((&FSStore{}).Name(), New)
+	modules.Register(modName, New)
+	modules.Register("table.fs", New)
 }
diff --git a/internal/storage/blob/fs/fs_test.go b/internal/storage/blob/fs/fs_test.go
index ec4635e4a..e3b6ed1b2 100644
--- a/internal/storage/blob/fs/fs_test.go
+++ b/internal/storage/blob/fs/fs_test.go
@@ -13,8 +13,16 @@ import (
 func TestFS(t *testing.T) {
 	blob.TestStore(t, func() module.BlobStore {
 		dir := testutils.Dir(t)
-		return &FSStore{instName: "test", root: dir}
+
+		root, err := os.OpenRoot(dir)
+		require.NoError(t, err)
+
+		return &FSStore{
+			instName: "test",
+			rootPath: dir,
+			root: root,
+		}
 	}, func(store module.BlobStore) {
-		require.NoError(t, os.RemoveAll(store.(*FSStore).root))
+		require.NoError(t, os.RemoveAll(store.(*FSStore).rootPath))
 	})
 }
diff --git a/internal/storage/blob/s3/s3.go b/internal/storage/blob/s3/s3.go
index 4b2c0d630..585604a75 100644
--- a/internal/storage/blob/s3/s3.go
+++ b/internal/storage/blob/s3/s3.go
@@ -197,4 +197,5 @@ func (s *Store) Delete(ctx context.Context, keys []string) error {
 func init() {
 	var _ module.BlobStore = &Store{}
 	modules.Register(modName, New)
+	modules.Register("table.s3", New)
 }
diff --git a/internal/table/cache.go b/internal/table/cache.go
new file mode 100644
index 000000000..1e7c70b17
--- /dev/null
+++ b/internal/table/cache.go
@@ -0,0 +1,43 @@
+package table
+
+import (
+	"context"
+
+	"github.com/foxcpp/maddy/framework/module"
+	lru "github.com/hashicorp/golang-lru/v2"
+)
+
+type CachedTable struct {
+	source module.Table
+	cache *lru.TwoQueueCache[string, string]
+}
+
+var _ module.Table = CachedTable{}
+
+func NewCachedTable(source module.Table, size int) (module.Table, error) {
+	cache, err := lru.New2Q[string, string](size)
+	if err != nil {
+		return nil, err
+	}
+
+	return CachedTable{
+		source: source,
+		cache: cache,
+	}, nil
+}
+
+func (t CachedTable) Lookup(ctx context.Context, key string) (string, bool, error) {
+	value, ok := t.cache.Get(key)
+	if ok {
+		return value, true, nil
+	}
+
+	value, ok, err := t.source.Lookup(ctx, key)
+	if err != nil {
+		return "", ok, err
+	}
+
+	t.cache.Add(key, value)
+
+	return value, ok, nil
+}
diff --git a/internal/table/file.go b/internal/table/file/file.go
similarity index 99%
rename from internal/table/file.go
rename to internal/table/file/file.go
index 47d8f372b..b0458d9c4 100644
--- a/internal/table/file.go
+++ b/internal/table/file/file.go
@@ -16,7 +16,7 @@ You should have received a copy of the GNU General Public License
 along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 
-package table
+package file
 
 import (
 	"bufio"
diff --git a/internal/table/file_test.go b/internal/table/file/file_test.go
similarity index 99%
rename from internal/table/file_test.go
rename to internal/table/file/file_test.go
index 20335eb1b..3ebf7b408 100644
--- a/internal/table/file_test.go
+++ b/internal/table/file/file_test.go
@@ -16,7 +16,7 @@ You should have received a copy of the GNU General Public License
 along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 
-package table
+package file
 
 import (
 	"os"
diff --git a/internal/table/sql_query.go b/internal/table/sql/sql_query.go
similarity index 99%
rename from internal/table/sql_query.go
rename to internal/table/sql/sql_query.go
index 248dc8746..2d2719019 100644
--- a/internal/table/sql_query.go
+++ b/internal/table/sql/sql_query.go
@@ -16,7 +16,7 @@ You should have received a copy of the GNU General Public License
 along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 
-package table
+package sql
 
 import (
 	"context"
diff --git a/internal/table/sql_query_test.go b/internal/table/sql/sql_query_test.go
similarity index 99%
rename from internal/table/sql_query_test.go
rename to internal/table/sql/sql_query_test.go
index a81f1bfeb..f81241a4b 100644
--- a/internal/table/sql_query_test.go
+++ b/internal/table/sql/sql_query_test.go
@@ -19,7 +19,7 @@ You should have received a copy of the GNU General Public License
 along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 
-package table
+package sql
 
 import (
 	"context"
diff --git a/internal/table/sql_table.go b/internal/table/sql/sql_table.go
similarity index 99%
rename from internal/table/sql_table.go
rename to internal/table/sql/sql_table.go
index c8f802168..869261524 100644
--- a/internal/table/sql_table.go
+++ b/internal/table/sql/sql_table.go
@@ -16,7 +16,7 @@ You should have received a copy of the GNU General Public License
 along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 
-package table
+package sql
 
 import (
 	"context"
diff --git a/maddy.go b/maddy.go
index ba1156495..1ae32ddcc 100644
--- a/maddy.go
+++ b/maddy.go
@@ -29,9 +29,9 @@ import (
 	"sync"
 
 	"github.com/caddyserver/certmagic"
-	parser "github.com/foxcpp/maddy/framework/cfgparser"
 	"github.com/foxcpp/maddy/framework/config"
 	modconfig "github.com/foxcpp/maddy/framework/config/module"
+	"github.com/foxcpp/maddy/framework/config/parser"
 	"github.com/foxcpp/maddy/framework/config/tls"
 	"github.com/foxcpp/maddy/framework/container"
 	"github.com/foxcpp/maddy/framework/hooks"
@@ -47,10 +47,12 @@ import (
 	_ "github.com/foxcpp/maddy/internal/auth/external"
 	_ "github.com/foxcpp/maddy/internal/auth/ldap"
 	_ "github.com/foxcpp/maddy/internal/auth/netauth"
+	_ "github.com/foxcpp/maddy/internal/auth/oauth"
 	_ "github.com/foxcpp/maddy/internal/auth/pam"
 	_ "github.com/foxcpp/maddy/internal/auth/pass_table"
 	_ "github.com/foxcpp/maddy/internal/auth/plain_separate"
 	_ "github.com/foxcpp/maddy/internal/auth/shadow"
+	_ "github.com/foxcpp/maddy/internal/auth/tls"
 	_ "github.com/foxcpp/maddy/internal/check/authorize_sender"
 	_ "github.com/foxcpp/maddy/internal/check/command"
 	_ "github.com/foxcpp/maddy/internal/check/dkim"
@@ -73,6 +75,8 @@ import (
 	_ "github.com/foxcpp/maddy/internal/storage/blob/s3"
 	_ "github.com/foxcpp/maddy/internal/storage/imapsql"
 	_ "github.com/foxcpp/maddy/internal/table"
+	_ "github.com/foxcpp/maddy/internal/table/file"
+	_ "github.com/foxcpp/maddy/internal/table/sql"
 	_ "github.com/foxcpp/maddy/internal/target/queue"
 	_ "github.com/foxcpp/maddy/internal/target/remote"
 	_ "github.com/foxcpp/maddy/internal/target/smtp"
diff --git a/tests/sasl_external_test.go b/tests/sasl_external_test.go
new file mode 100644
index 000000000..9e21a55f4
--- /dev/null
+++ b/tests/sasl_external_test.go
@@ -0,0 +1,212 @@
+//go:build integration
+
+/*
+Maddy Mail Server - Composable all-in-one email server.
+Copyright © 2019-2026 Max Mazurov <fox.cpp@disroot.org>, Maddy Mail Server contributors
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+package tests_test
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"os"
+	"strconv"
+	"testing"
+
+	"github.com/emersion/go-sasl"
+	"github.com/emersion/go-smtp"
+	"github.com/foxcpp/maddy/tests"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSMTPSASLExternalTLS(tt *testing.T) {
+	tt.Parallel()
+	t := tests.NewT(tt)
+
+	smtpPort := t.Port("smtp")
+	t.DNS(nil)
+	t.Config(`
+		smtp tls://127.0.0.1:{env:TEST_PORT_smtp} {
+			hostname mx.maddy.test
+			tls {
+				loader file {env:TEST_PWD}/testdata/tls/server.crt {env:TEST_PWD}/testdata/tls/server.key
+				client_ca {env:TEST_PWD}/testdata/tls/ca.crt
+				client_auth verify_if_given
+			}
+			auth tls
+			auth dummy
+
+			# Use authorize_sender to quickly check effective auth username via MAIL FROM.
+			defer_sender_reject
+			check {
+				authorize_sender
+			}
+
+			deliver_to dummy
+		}
+	`)
+	t.Run(1)
+	defer t.Close()
+
+	caPool := x509.NewCertPool()
+	caPEM, err := os.ReadFile("testdata/tls/ca.crt")
+	require.NoError(t, err)
+	caPool.AppendCertsFromPEM(caPEM)
+
+	loadCert := func(t *tests.T, crtPath, keyPath string) tls.Certificate {
+		crt, err := tls.LoadX509KeyPair(crtPath, keyPath)
+		require.NoError(t, err)
+		return crt
+	}
+
+	t.Subtest("no client cert", func(t *tests.T) {
+		// No client certificate provided - SASL EXTERNAL will fail.
+		smtpConn, err := smtp.DialTLS("127.0.0.1:"+strconv.Itoa(int(smtpPort)), &tls.Config{
+			ServerName: "mx.maddy.test",
+			RootCAs: caPool,
+		})
+		require.NoError(t, err)
+		defer smtpConn.Close()
+
+		require.True(t, smtpConn.SupportsAuth(sasl.External))
+		require.Error(t, smtpConn.Auth(sasl.NewExternalClient("")))
+	})
+
+	t.Subtest("wrong cert usage", func(t *tests.T) {
+		smtpConn, err := smtp.DialTLS("127.0.0.1:"+strconv.Itoa(int(smtpPort)), &tls.Config{
+			ServerName: "mx.maddy.test",
+			RootCAs: caPool,
+			Certificates: []tls.Certificate{
+				loadCert(
+					t,
+					"testdata/tls/client_san_email_no_usage.crt",
+					"testdata/tls/client_san_email_no_usage.key",
+				),
+			},
+		})
+		require.NoError(t, err)
+		defer smtpConn.Close()
+
+		require.True(t, smtpConn.SupportsAuth(sasl.External))
+		require.Error(t, smtpConn.Auth(sasl.NewExternalClient("")))
+	})
+
+	t.Subtest("CN cert", func(t *tests.T) {
+		smtpConn, err := smtp.DialTLS("127.0.0.1:"+strconv.Itoa(int(smtpPort)), &tls.Config{
+			ServerName: "mx.maddy.test",
+			RootCAs: caPool,
+			Certificates: []tls.Certificate{
+				loadCert(
+					t,
+					"testdata/tls/client_cn.crt",
+					"testdata/tls/client_cn.key",
+				),
+			},
+		})
+		require.NoError(t, err)
+		defer smtpConn.Close()
+
+		require.True(t, smtpConn.SupportsAuth(sasl.External))
+		require.NoError(t, smtpConn.Auth(sasl.NewExternalClient("")))
+
+		require.NoError(t, smtpConn.Mail("cn@maddy.test", nil))
+	})
+
+	t.Subtest("SAN email cert", func(t *tests.T) {
+		smtpConn, err := smtp.DialTLS("127.0.0.1:"+strconv.Itoa(int(smtpPort)), &tls.Config{
+			ServerName: "mx.maddy.test",
+			RootCAs: caPool,
+			Certificates: []tls.Certificate{
+				loadCert(
+					t,
+					"testdata/tls/client_san_email.crt",
+					"testdata/tls/client_san_email.key",
+				),
+			},
+		})
+		require.NoError(t, err)
+		defer smtpConn.Close()
+
+		require.True(t, smtpConn.SupportsAuth(sasl.External))
+		require.NoError(t, smtpConn.Auth(sasl.NewExternalClient("")))
+
+		require.NoError(t, smtpConn.Mail("san@maddy.test", nil))
+	})
+
+	t.Subtest("SAN email cert - multiple default", func(t *tests.T) {
+		smtpConn, err := smtp.DialTLS("127.0.0.1:"+strconv.Itoa(int(smtpPort)), &tls.Config{
+			ServerName: "mx.maddy.test",
+			RootCAs: caPool,
+			Certificates: []tls.Certificate{
+				loadCert(
+					t,
+					"testdata/tls/client_san_email_multi.crt",
+					"testdata/tls/client_san_email_multi.key",
+				),
+			},
+		})
+		require.NoError(t, err)
+		defer smtpConn.Close()
+
+		require.True(t, smtpConn.SupportsAuth(sasl.External))
+		require.NoError(t, smtpConn.Auth(sasl.NewExternalClient("")))
+
+		require.NoError(t, smtpConn.Mail("san1@maddy.test", nil))
+	})
+
+	t.Subtest("SAN email cert - multiple 1", func(t *tests.T) {
+		smtpConn, err := smtp.DialTLS("127.0.0.1:"+strconv.Itoa(int(smtpPort)), &tls.Config{
+			ServerName: "mx.maddy.test",
+			RootCAs: caPool,
+			Certificates: []tls.Certificate{
+				loadCert(
+					t,
+					"testdata/tls/client_san_email_multi.crt",
+					"testdata/tls/client_san_email_multi.key",
+				),
+			},
+		})
+		require.NoError(t, err)
+		defer smtpConn.Close()
+
+		require.True(t, smtpConn.SupportsAuth(sasl.External))
+		require.NoError(t, smtpConn.Auth(sasl.NewExternalClient("san1@maddy.test")))
+
+		require.NoError(t, smtpConn.Mail("san1@maddy.test", nil))
+	})
+
+	t.Subtest("SAN email cert - multiple 2", func(t *tests.T) {
+		smtpConn, err := smtp.DialTLS("127.0.0.1:"+strconv.Itoa(int(smtpPort)), &tls.Config{
+			ServerName: "mx.maddy.test",
+			RootCAs: caPool,
+			Certificates: []tls.Certificate{
+				loadCert(
+					t,
+					"testdata/tls/client_san_email_multi.crt",
+					"testdata/tls/client_san_email_multi.key",
+				),
+			},
+		})
+		require.NoError(t, err)
+		defer smtpConn.Close()
+
+		require.True(t, smtpConn.SupportsAuth(sasl.External))
+		require.NoError(t, smtpConn.Auth(sasl.NewExternalClient("san2@maddy.test")))
+
+		require.NoError(t, smtpConn.Mail("san2@maddy.test", nil))
+	})
+}
diff --git a/tests/sasl_oauth_test.go b/tests/sasl_oauth_test.go
new file mode 100644
index 000000000..7a01702da
--- /dev/null
+++ b/tests/sasl_oauth_test.go
@@ -0,0 +1,79 @@
+//go:build integration
+
+package tests_test
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+
+	"github.com/emersion/go-sasl"
+	"github.com/emersion/go-smtp"
+	"github.com/foxcpp/maddy/tests"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSMTPOAuthSASL(tt *testing.T) {
+	tt.Parallel()
+
+	var introspectionResult map[string]any
+	var introspectionStatusCode int
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(tt, http.MethodGet, r.Method)
+		assert.Equal(tt, "/introspect", r.URL.String())
+		assert.Equal(tt, "Bearer testtoken", r.Header.Get("Authorization"))
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(introspectionStatusCode)
+
+		err := json.NewEncoder(w).Encode(introspectionResult)
+		require.NoError(tt, err)
+	}))
+	tt.Cleanup(srv.Close)
+
+	t := tests.NewT(tt)
+	t.DNS(nil)
+	smtpPort := t.Port("smtp")
+	t.Config(`
+
+smtp tcp://127.0.0.1:{env:TEST_PORT_smtp} {
+	tls off
+	insecure_auth
+	hostname mx.maddy.test
+	auth oauth {
+		introspection auth
+		introspection_url ` + srv.URL + `/introspect
+	}
+
+	# Use authorize_sender to quickly check effective auth username via MAIL FROM.
+	defer_sender_reject
+	check {
+		authorize_sender
+	}
+
+	deliver_to dummy
+}
+`)
+	t.Run(1)
+	defer t.Close()
+
+	introspectionResult = map[string]any{
+		"email": "testuser@maddy.test",
+	}
+	introspectionStatusCode = http.StatusOK
+
+	client, err := smtp.Dial("127.0.0.1:" + strconv.Itoa(int(smtpPort)))
+	require.NoError(t, err)
+	defer client.Close()
+
+	require.NoError(t, client.Hello("localhost"))
+	require.True(t, client.SupportsAuth(sasl.OAuthBearer))
+	require.NoError(t, client.Auth(sasl.NewOAuthBearerClient(&sasl.OAuthBearerOptions{
+		Username: "",
+		Token: "testtoken",
+	})))
+	require.NoError(t, client.Mail("testuser@maddy.test", nil))
+}
diff --git a/tests/testdata/tls/init.sh b/tests/testdata/tls/init.sh
new file mode 100644
index 000000000..1e53a8e0e
--- /dev/null
+++ b/tests/testdata/tls/init.sh
@@ -0,0 +1,40 @@
+#!/bin/sh
+
+# Generate CA key and certificate
+openssl req -x509 -newkey rsa:4096 -keyout ca.key -out ca.crt -days 36500 -nodes -subj "/CN=maddy.test"
+
+# Generate server certificate.
+openssl req -new -nodes -newkey rsa:4096 -keyout server.key -out server.req -batch \
+ -subj "/CN=mx.maddy.test" \
+ -addext "subjectAltName = DNS:mx.maddy.test" \
+ -addext "keyUsage = keyEncipherment" \
+ -addext "extendedKeyUsage = serverAuth"
+openssl x509 -req -in server.req -CA ca.crt -CAkey ca.key -copy_extensions copy -out server.crt -days 36500
+
+# Generate test client certs.
+openssl req -new -nodes -newkey rsa:4096 -keyout client_cn.key -out client_cn.req -batch \
+ -subj "/CN=cn@maddy.test" \
+ -addext "keyUsage = digitalSignature" \
+ -addext "extendedKeyUsage = clientAuth"
+openssl x509 -req -in client_cn.req -CA ca.crt -CAkey ca.key -copy_extensions copy -out client_cn.crt -days 36500
+
+openssl req -new -nodes -newkey rsa:4096 -keyout client_san_email.key -out client_san_email.req -batch \
+ -subj "/CN=SAN test" \
+ -addext "subjectAltName = email:san@maddy.test" \
+ -addext "keyUsage = digitalSignature" \
+ -addext "extendedKeyUsage = clientAuth"
+openssl x509 -req -in client_san_email.req -CA ca.crt -CAkey ca.key -copy_extensions copy -out client_san_email.crt -days 36500
+
+openssl req -new -nodes -newkey rsa:4096 -keyout client_san_email_multi.key -out client_san_email_multi.req -batch \
+ -subj "/CN=SAN test" \
+ -addext "subjectAltName = email:san1@maddy.test,email:san2@maddy.test" \
+ -addext "keyUsage = digitalSignature" \
+ -addext "extendedKeyUsage = clientAuth"
+openssl x509 -req -in client_san_email_multi.req -CA ca.crt -CAkey ca.key -copy_extensions copy -out client_san_email_multi.crt -days 36500
+
+openssl req -new -nodes -newkey rsa:4096 -keyout client_san_email_no_usage.key -out client_san_email_no_usage.req -batch \
+ -subj "/CN=SAN test" \
+ -addext "subjectAltName = email:san@maddy.test"
+openssl x509 -req -in client_san_email_no_usage.req -CA ca.crt -CAkey ca.key -copy_extensions copy -out client_san_email_no_usage.crt -days 36500
+
+rm *.req
</div><div class="naked_ctrl">
<form action="/index.cgi/contrast" method="get" name="gate">
<p><a href="http://altstyle.alfasado.net">AltStyle</a> によって変換されたページ <a href="https://github.com/foxcpp/maddy/compare/master...dev.diff">(-&gt;オリジナル)</a>
/ <label>アドレス: <input type="text" name="naked_post_url" value="https://github.com/foxcpp/maddy/compare/master...dev.diff" size="22" /></label> <label>モード: <select name="naked_post_mode">
<option value="default">デフォルト</option>
<option value="speech">音声ブラウザ</option>
<option value="ruby">ルビ付き</option>
<option value="contrast" selected="selected">配色反転</option>
<option value="larger-text">文字拡大</option>
<option value="mobile">モバイル</option>
</select>
<input type="submit" value="表示" />
</p>
</form>
</div>