From Anon Ymous:

1) libsaslc is an SASL client only.
2) dovecot is an SASL server only.
3) cyrus-sasl is both a client and a server.
4) postfix allows us to have multiple SASL servers and clients.
5) The SASL server to use at runtime is determined by the setting of
   "smtpd_sasl_type" in main.cf (note that is smtpd_ not smtp_).  If
   that is not set, then it defaults to the value of
   DEF_SERVER_SASL_TYPE at build time, which if not set, defaults to
   "cyrus".  See postfix/dist/src/global/mail_params.h.
6) The SASL client to use at runtime is determined by the setting of
   "smtp_sasl_type" in main.cf.  If that is not set, then it defaults
   to the value of DEF_CLIENT_SASL_TYPE at build time, which if not
   set, defaults to "cyrus".  See postfix/dist/src/global/mail_params.h.
7) If MKCRYPTO is "no", libsaslc will not link as it requires the
   crypto libraries, so libsaslc cannot be enabled (as it was before)
   without crypto.
8) I have made the definition of DEF_CLIENT_SASL_TYPE conditional on
   MKCRYPTO due to (7).  Without crypto it will default to cyrus.
9) HAVE_CYRUS_SASL is _never_ defined during a normal build and _never_
   should be!  It is there for the convenience of users who wish to
   install cyrus-sasl and rebuild postfix with it.  It is also very
   useful for testing if it is suspected that something might be wrong
   with libsaslc.  PLEASE DO NOT REMOVE IT!

external/ibm-public/postfix/Makefile.inc

@@ -1,9 +1,8 @@
-#	$NetBSD: Makefile.inc,v 1.8 2011/02/13 05:45:47 christos Exp $
+#	$NetBSD: Makefile.inc,v 1.9 2011/02/15 16:19:33 christos Exp $
 
 .include <bsd.own.mk>
 
 USE_FORT?= yes	# network client and server
-USE_LIB_SASL?= saslc
 PKGROOT?= /usr/pkg
 
 WARNS?=	0
@@ -17,23 +16,25 @@ CPPFLAGS+= -DNETBSD4 -DUSE_SASL_AUTH \
 	-I${PFIX_DISTDIR}/src/tls -I${PFIX_DISTDIR}/src/milter \
 	-I${PFIX_DISTDIR}/src/xsasl
 
-.if ${USE_LIB_SASL} == "saslc"
-CPPFLAGS+= -DUSE_SASL_AUTH -DUSE_SASLC_SASL
+CPPFLAGS+= -DUSE_SASL_AUTH
+CPPFLAGS+= -DDEF_SERVER_SASL_TYPE=\"dovecot\"
+
 .if (${MKCRYPTO} != "no")
+CPPFLAGS+= -DUSE_SASLC_SASL
+CPPFLAGS+= -DDEF_CLIENT_SASL_TYPE=\"saslc\"
 DPADD+= ${LIBSASCL} ${LIBSSL}
 LDADD+= -lsaslc -lssl
-.if (${MKKERBEROS} != "no")
+. if (${MKKERBEROS} != "no")
 DPADD+= ${LIBGSSAPI}
 LDADD+= -lgssapi
+. endif
 .endif
-.endif
-.elif ${USE_LIB_SASL} == "cyrus"
+
+# XXX: Use only if you have cyrus-sasl installed; never part of a normal build!
+.if defined(HAVE_CYRUS_SASL)
 CPPFLAGS+= -DUSE_SASL_AUTH -DUSE_CYRUS_SASL \
-	-DDEF_SERVER_SASL_TYPE=\"cyrus\" \
 	-I${PKGROOT}/include/sasl
 LDADD+= -L${PKGROOT}/lib -Wl,-R${PKGROOT}/lib -lsasl2 
-.else
-CPPFLAGS+= -DDEF_SERVER_SASL_TYPE=\"dovecot\"
 .endif
 
 .if defined(HAVE_PCC)