Function verify_plain 

pub fn verify_plain<S: BuildHasher>(
    creds: &HashMap<String, String, S>,
    user: &str,
    password: &[u8],
) -> Result<Principal, AuthError>

Verifies a SASL/PLAIN auth attempt against a static credential map.

On a known user, the password comparison is constant-time. On an unknown user, this function returns UnknownUser. The wire response upstream collapses both outcomes to SASL_AUTHENTICATION_FAILED.

skip_all keeps creds and the raw password bytes out of the span fields. Only the non-sensitive user and mechanism name are recorded. err surfaces AuthError (Debug) without leaking the password.

Errors

Returns an error when credentials or key material are invalid, cryptographic verification fails, or the TLS, SASL, or Kerberos exchange is rejected.