From 3c9c58b921a6c2c889fc97f795f7fbeb4db19ef9 Mon Sep 17 00:00:00 2001
From: Dan Caseley <dan@caseley.me.uk>
Date: Sun, 13 Sep 2026 15:43:18 +0100
Subject: [PATCH 1/2] Satisfy the linter

---
 .../java/org/jivesoftware/smack/sasl/core/ScramMechanism.java   | 1 -
 .../java/org/jivesoftware/smack/sasl/ht/SaslHtMechanism.java    | 2 --
 .../smack/sasl/sasl2/Sasl2FastAuthenticationTest.java           | 2 --
 3 files changed, 5 deletions(-)

diff --git a/smack-core/src/main/java/org/jivesoftware/smack/sasl/core/ScramMechanism.java b/smack-core/src/main/java/org/jivesoftware/smack/sasl/core/ScramMechanism.java
index 2d9d131c89..bff74e6b74 100644
--- a/smack-core/src/main/java/org/jivesoftware/smack/sasl/core/ScramMechanism.java
+++ b/smack-core/src/main/java/org/jivesoftware/smack/sasl/core/ScramMechanism.java
@@ -29,7 +29,6 @@
 import org.jivesoftware.smack.SmackException.SmackSaslException;
 import org.jivesoftware.smack.sasl.SASLMechanism;
 import org.jivesoftware.smack.util.ByteUtils;
-import org.jivesoftware.smack.util.SHA1;
 import org.jivesoftware.smack.util.StringUtils;
 import org.jivesoftware.smack.util.stringencoder.Base64;
 
diff --git a/smack-core/src/main/java/org/jivesoftware/smack/sasl/ht/SaslHtMechanism.java b/smack-core/src/main/java/org/jivesoftware/smack/sasl/ht/SaslHtMechanism.java
index 7b44e052c6..571af8591d 100644
--- a/smack-core/src/main/java/org/jivesoftware/smack/sasl/ht/SaslHtMechanism.java
+++ b/smack-core/src/main/java/org/jivesoftware/smack/sasl/ht/SaslHtMechanism.java
@@ -36,8 +36,6 @@
 import org.jivesoftware.smack.util.ByteUtils;
 import org.jivesoftware.smack.util.TLSUtils;
 
-import org.jxmpp.jid.DomainBareJid;
-
 public abstract class SaslHtMechanism extends SASLMechanism {
 
     public enum HashAlgorithm {
diff --git a/smack-core/src/test/java/org/jivesoftware/smack/sasl/sasl2/Sasl2FastAuthenticationTest.java b/smack-core/src/test/java/org/jivesoftware/smack/sasl/sasl2/Sasl2FastAuthenticationTest.java
index 12d789cc14..f68be06e0b 100644
--- a/smack-core/src/test/java/org/jivesoftware/smack/sasl/sasl2/Sasl2FastAuthenticationTest.java
+++ b/smack-core/src/test/java/org/jivesoftware/smack/sasl/sasl2/Sasl2FastAuthenticationTest.java
@@ -76,9 +76,7 @@
 
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
-import org.jxmpp.jid.DomainBareJid;
 import org.jxmpp.jid.EntityFullJid;
-import org.jxmpp.jid.impl.JidCreate;
 import org.jxmpp.jid.parts.Resourcepart;
 
 public class Sasl2FastAuthenticationTest extends SmackTestSuite {

From b10cf9dc1f938957b60c433b0d1df07a6ac96cce Mon Sep 17 00:00:00 2001
From: Dan Caseley <dan@caseley.me.uk>
Date: Sun, 13 Sep 2026 15:45:37 +0100
Subject: [PATCH 2/2] Ensure user-agent id is a UUID
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

per XEP-0388 § 2.3: "The contents of the 'id' attribute MUST be a UUID v4."
---
 .../smack/sasl/sasl2/Sasl2Module.java         | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/smack-core/src/main/java/org/jivesoftware/smack/sasl/sasl2/Sasl2Module.java b/smack-core/src/main/java/org/jivesoftware/smack/sasl/sasl2/Sasl2Module.java
index bffc56beb5..dc3fec04cb 100644
--- a/smack-core/src/main/java/org/jivesoftware/smack/sasl/sasl2/Sasl2Module.java
+++ b/smack-core/src/main/java/org/jivesoftware/smack/sasl/sasl2/Sasl2Module.java
@@ -18,6 +18,7 @@
 
 import java.io.IOException;
 import java.util.List;
+import java.util.UUID;
 
 import org.jivesoftware.smack.SmackException;
 import org.jivesoftware.smack.XMPPException;
@@ -41,6 +42,21 @@ public class Sasl2Module extends ModularXmppClientToServerConnectionModule<Sasl2
 
     private Sasl2AuthenticationResult sasl2AuthenticationResult;
 
+    /**
+     * A stable identifier for this connection's "client installation", per XEP-0388 § 2.3: "The contents of the
+     * 'id' attribute MUST be a UUID v4." Generated once per {@link Sasl2Module} instance (i.e. once per connection
+     * object) rather than fresh on every authentication attempt, since a FAST (XEP-0484) token requested under one
+     * id can only be redeemed under that same id: servers key stored tokens by (username, mechanism, clientId).
+     */
+    private final String userAgentId = UUID.randomUUID().toString();
+
+    /**
+     * Returns this connection's stable SASL2 {@code <user-agent/>} 'id' value (see {@link #userAgentId}).
+     */
+    public String getUserAgentId() {
+        return userAgentId;
+    }
+
     protected Sasl2Module(Sasl2ModuleDescriptor moduleDescriptor,
                     ModularXmppClientToServerConnectionInternal connectionInternal) {
         super(moduleDescriptor, connectionInternal);
@@ -121,7 +137,8 @@ public StateTransitionResult.AttemptResult transitionInto(WalkStateGraphContext
                         sasl2Extensions.add(new org.jivesoftware.smack.fast.element.FastElements.RequestToken(prefMech));
                     }
                 }
-                sasl2Extensions.add(new org.jivesoftware.smack.sasl.packet.Sasl2Nonza.UserAgent("smack-client-instance", "Smack", null));
+                Sasl2Module sasl2Module = connectionInternal.connection.getConnectionModuleFor(Sasl2ModuleDescriptor.class);
+                sasl2Extensions.add(new org.jivesoftware.smack.sasl.packet.Sasl2Nonza.UserAgent(sasl2Module.userAgentId, "Smack", null));
             }
 
             if (!useBind2) {