I got a working postfix/dovecot configuration running with the following rule for recipients rejection:
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject
This works as intended (authorize authenticated users or users from mynetworks, reject others). However if a user coming from mynetworks fails to authenticate he is not rejected.
Is there such a rule as reject_invalid_sasl_auth? Something that would reject the user only if he entered an invalid authentication, but would allow users without authentication.
Otherwise, is there another way than restriction rules to achieve this kind of behavior (SASL option, custom policy)?