Openfire will broadcast support for SASL mechanisms depending on a configured default (or a configured list of names), combined with some checks against support for the Authorization Provider that's in use (if the SASL mechanism would need to have access to the original password, the provider needs to be able to provide that things like that).

There is no check if there actually is a SASL implementation available. Such a check should be added.