Only test for LOGINDISABLED when the auth method actually is 'login'.

Otherwise, servers which only allow e.g. CRAM/DIGEST-MD5 are locked out.

src/login.php

@@ -55,17 +55,19 @@ header('Pragma: no-cache');
  * squelches the display of the login form and puts up a message
  * explaining the situation.
  */
-$imap = sqimap_create_stream($imapServerAddress, $imapPort, $use_imap_tls);
-$logindisabled = sqimap_capability($imap,'LOGINDISABLED');
-sqimap_logout($imap);
-if ($logindisabled) {
-    $string = "The IMAP server is reporting that logins are disabled.<br>";
-    if (!$use_imap_tls) {
-        $string .= "The use of TLS may allow SquirrelMail to login.<br>";
+if($imap_auth_mech == 'login') {
+    $imap = sqimap_create_stream($imapServerAddress, $imapPort, $use_imap_tls);
+    $logindisabled = sqimap_capability($imap,'LOGINDISABLED');
+    sqimap_logout($imap);
+    if ($logindisabled) {
+        $string = "The IMAP server is reporting that logins are disabled.<br>";
+        if (!$use_imap_tls) {
+            $string .= "The use of TLS may allow SquirrelMail to login.<br>";
+        }
+        $string .= "Please contact your system administrator.";
+        error_box($string,$color);
+        exit;
     }
-    $string .= "Please contact your system administrator.";
-    error_box($string,$color);
-    exit;
 }
 
 do_hook('login_cookie');