The protocol is relatively straightforward. Primary complications include supporting various authentication mechanisms (GSSAPI , CRAM-MD5 , NTLM , MSN, AUTH LOGIN, AUTH PLAIN, etc.), handling error responses, and falling back when authentication mechanisms fail (e.g., the server claims to support a mechanism, but doesn't).