How does D-Bus authentication work over a socket connection?

Before any D-Bus messages are exchanged, a newly opened connection has to complete an authentication handshake using a simple text-based protocol layered directly on the socket, based on a subset of SASL (Simple Authentication and Security Layer).

The client sends a null byte followed by an AUTH command naming a mechanism it wants to use. The most common on local Unix sockets is EXTERNAL, which relies on the kernel-verified UID of the socket's peer rather than a password, since the operating system itself already vouches for who owns the connection. Other mechanisms exist, such as DBUS_COOKIE_SHA1, a cookie-based challenge scheme, and ANONYMOUS for connections that don't need identity verification at all.

Once authentication succeeds, the connection typically completes a BEGIN handshake and, for a bus connection (as opposed to raw peer-to-peer), sends a Hello method call to the bus daemon, which assigns it its unique connection name and formally admits it onto the bus.