Though this is actually part of Cyrus SASL2, we cannot simply enable it in security/cyrus-sasl2 to avoid dependency loop with net/openldap.