Mysql – Postfix cannot authenticate against SASL

My system is Debian 7 aka Wheezy with postfix, courier, and mysql installed. Courier works well and if I issue

testsaslauthd -u user@domain -p password -f /var/spool/postfix/var/run/saslauthd/mux -s smtp

I get a

0: OK "Success."

However, if I get an base64 encoded username/password with

echo -ne '\000user@domain\000password' | openssl base64

and try to use that in a SMTP session using

helo localhost
auth plain (output from above)

I always get a

535 5.7.8 Error: authentication failed: authentication failure

In /var/log/syslog I find then

Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: warning: SASL authentication failure: Password verification failed
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: warning: localhost[::1]: SASL plain authentication failed: authentication failure

and in /var/log/auth.log

Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin Parse the username username@domain
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin try and connect to a host
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin trying to open db 'postfixadmin' on host '127.0.0.1'
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: begin transaction
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin create statement from userPassword username domain
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin doing query SELECT password FROM mailbox WHERE username="username@domain";
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: commit transaction
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin Parse the username username@domain
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin try and connect to a host
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin trying to open db 'postfixadmin' on host '127.0.0.1'
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin Parse the username username@domain
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin try and connect to a host
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin trying to open db 'postfixadmin' on host '127.0.0.1'
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: begin transaction
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin create statement from userPassword username domain
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin doing query SELECT password FROM mailbox WHERE username="username@domain";
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin create statement from cmusaslsecretPLAIN username domain
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin doing query SELECT password FROM mailbox WHERE username="username@domain";
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: commit transaction
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin Parse the username username@domain
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin try and connect to a host
Sep 29 21:49:34 (hostname obfuscated) postfix/smtpd[15814]: sql plugin trying to open db 'postfixadmin' on host '127.0.0.1'

Relevant SASL entries in my postfix configuration:

# postconf | grep -e cyrus_sasl -e smtpd_sasl
cyrus_sasl_config_path =
send_cyrus_sasl_authzid = no
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_exceptions_networks =
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_path = smtpd
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
smtpd_sasl_type = cyrus

Can anyone give me a hint how to analyse or debug this?

Update 2014/10/01: After trying around more and more, I found out that it is definitely a problem with reading the password from the mysql database. I edited /etc/postfix/sasl/smtpd.conf and in the last line I wrote

sql_select: SELECT 'some hardcoded password' password FROM mailbox WHERE username="%u@%r"

and now it works. However, this is obviously not what I intended to do.

Second Update 2014/10/01: Interesting… When smtpd.conf just contains

pwcheck_method: saslauthd
mech_list: plain login

everything works as it should! Solved for me.