1 files changed, 3 insertions, 3 deletions
diff --git a/Swiften/Client/ClientSession.cpp b/Swiften/Client/ClientSession.cpp
index f03cbaa..b29f63d 100644
--- a/Swiften/Client/ClientSession.cpp
+++ b/Swiften/Client/ClientSession.cpp
@@ -191,78 +191,78 @@ void ClientSession::handleElement(boost::shared_ptr<Element> element) {
 		}
 	}
 	else if (StreamFeatures* streamFeatures = dynamic_cast<StreamFeatures*>(element.get())) {
 		CHECK_STATE_OR_RETURN(Negotiating);
 
 		if (streamFeatures->hasStartTLS() && stream->supportsTLSEncryption() && useTLS != NeverUseTLS) {
 			state = WaitingForEncrypt;
 			stream->writeElement(boost::make_shared<StartTLSRequest>());
 		}
 		else if (useTLS == RequireTLS && !stream->isTLSEncrypted()) {
 			finishSession(Error::NoSupportedAuthMechanismsError);
 		}
 		else if (useStreamCompression && stream->supportsZLibCompression() && streamFeatures->hasCompressionMethod("zlib")) {
 			state = Compressing;
 			stream->writeElement(boost::make_shared<CompressRequest>("zlib"));
 		}
 		else if (streamFeatures->hasAuthenticationMechanisms()) {
 			if (stream->hasTLSCertificate()) {
 				if (streamFeatures->hasAuthenticationMechanism("EXTERNAL")) {
 					authenticator = new EXTERNALClientAuthenticator();
 					state = Authenticating;
 					stream->writeElement(boost::make_shared<AuthRequest>("EXTERNAL", createSafeByteArray("")));
 				}
 				else {
 					finishSession(Error::TLSClientCertificateError);
 				}
 			}
 			else if (streamFeatures->hasAuthenticationMechanism("EXTERNAL")) {
 				authenticator = new EXTERNALClientAuthenticator();
 				state = Authenticating;
 				stream->writeElement(boost::make_shared<AuthRequest>("EXTERNAL", createSafeByteArray("")));
 			}
 			else if (streamFeatures->hasAuthenticationMechanism("SCRAM-SHA-1") || streamFeatures->hasAuthenticationMechanism("SCRAM-SHA-1-PLUS")) {
 				std::ostringstream s;
 				ByteArray finishMessage;
-				bool plus = stream->isTLSEncrypted() && streamFeatures->hasAuthenticationMechanism("SCRAM-SHA-1-PLUS");
-				if (plus) {
+				bool plus = streamFeatures->hasAuthenticationMechanism("SCRAM-SHA-1-PLUS");
+				if (stream->isTLSEncrypted()) {
 					finishMessage = stream->getTLSFinishMessage();
 					plus &= !finishMessage.empty();
 				}
 				s << boost::uuids::random_generator()();
 				SCRAMSHA1ClientAuthenticator* scramAuthenticator = new SCRAMSHA1ClientAuthenticator(s.str(), plus, idnConverter, crypto);
-				if (plus) {
+				if (!finishMessage.empty()) {
 					scramAuthenticator->setTLSChannelBindingData(finishMessage);
 				}
 				authenticator = scramAuthenticator;
 				state = WaitingForCredentials;
 				onNeedCredentials();
 			}
 			else if ((stream->isTLSEncrypted() || allowPLAINOverNonTLS) && streamFeatures->hasAuthenticationMechanism("PLAIN")) {
 				authenticator = new PLAINClientAuthenticator();
 				state = WaitingForCredentials;
 				onNeedCredentials();
 			}
 			else if (streamFeatures->hasAuthenticationMechanism("DIGEST-MD5") && crypto->isMD5AllowedForCrypto()) {
 				std::ostringstream s;
 				s << boost::uuids::random_generator()();
 				// FIXME: Host should probably be the actual host
 				authenticator = new DIGESTMD5ClientAuthenticator(localJID.getDomain(), s.str(), crypto);
 				state = WaitingForCredentials;
 				onNeedCredentials();
 			}
 			else {
 				finishSession(Error::NoSupportedAuthMechanismsError);
 			}
 		}
 		else {
 			// Start the session
 			rosterVersioningSupported = streamFeatures->hasRosterVersioning();
 			stream->setWhitespacePingEnabled(true);
 			needSessionStart = streamFeatures->hasSession();
 			needResourceBind = streamFeatures->hasResourceBind();
 			needAcking = streamFeatures->hasStreamManagement() && useAcks;
 			if (!needResourceBind) {
 				// Resource binding is a MUST
 				finishSession(Error::ResourceBindError);
 			}
 			else {