data/auth/anonymous-server-successful.auth-script \
data/auth/cancel.auth-script \
data/auth/client-out-of-mechanisms.auth-script \
+ data/auth/external-auto.auth-script \
data/auth/external-failed.auth-script \
data/auth/external-root.auth-script \
data/auth/external-silly.auth-script \
--- /dev/null
+# Test that we can authenticate with an empty authorization identity
+SERVER
+EXPECT_HAVE_NO_CREDENTIALS
+
+# C: "I want to use EXTERNAL, I decline to specify an initial response"
+SEND 'AUTH EXTERNAL'
+# S: "OK, who do you claim to be?"
+EXPECT_COMMAND DATA
+EXPECT_STATE WAITING_FOR_INPUT
+EXPECT_HAVE_NO_CREDENTIALS
+# C: "I am whoever the kernel says I am"
+SEND 'DATA'
+# S: "I suppose I can't argue with that"
+EXPECT_COMMAND OK
+EXPECT_STATE WAITING_FOR_INPUT
+SEND 'BEGIN'
+EXPECT_STATE AUTHENTICATED
+EXPECT_HAVE_SOME_CREDENTIALS