Topicbox-policy-reasoning: allow: sender is a member
Sorry for not being clear. Various clients (wireless via Cisco Ise in this case) do a BIND of the user in LDAP. LDAP then calls saslauthd (-a kerberos5) as we currently don't keep user passwords in LDAP.