Pop3 sasl AUTH PLAIN not supported over TLS?

My problem is that Thunberbird will not work with such settings and requires AUTH PLAIN to be supported when SASL is announced in CAPA.

My point was that the RFC states that AUTH PLAIN MUST be supported when SASL is announced on TLS connections.

I have filed a bug on Thunderbird bugtracker, but this looks more like a bug on the Cyrus implementation on Mac OS X 10.5.5.

Really? Well I'd really like to dig through this. Could you post more info about your setup so that we can compare and check where the problem is on my side?

My setup: Mac OS X Server 10.5.5 running Cyrus POP3 v2.3.8-OS X Server 10.5. SSL and TLS are enabled but not required. Port 995 is only port open for outside clients.
Thunberbird version 2.0.0.18 and 3 beta 1 cannot connect to POP over SSL or TLS. The error I get is: 'authentication failure'.
Non encrypted connection works (Thunberbird will issue a USER/PASS and will not use the AUTH PLAIN method).
SASL and Kerberos are enabled on the server.

If I connect with openssl on command line to port 995, then issue a CAPA command here is the result:
CAPA
+OK List of capabilities follows
SASL GSSAPI
EXPIRE NEVER
LOGIN-DELAY 0
TOP
UIDL
PIPELINING
RESP-CODES
AUTH-RESP-CODE
USER

Could you please post the result of the same test?
('openssl> s_client -connect 10.1.1.1:995', then type 'CAPA').

Thanks to help on this,
Nicolas.

The CAPA output is the same as yours, except I do not use Kerberos.

Do you mean that you do not have the SASL GSSAPI line? If so this is the clue to my problem.
If SASL is not announced, Thunberbird will not issue the AUTH PLAIN, etc (see RFC).
I guess disabling Kerberos will solve my problem (I want to be sure before doing so, this is a production server).

Ok I understand where the problem is. Btw how to you enable APOP ? I have not seen this option in the GUI.