[Fedora-directory-users] SSL/TLS vs SASL in Directory Server solution

Hi. We're planning on deploying Red Hat Directory Server 8.0, and could need some advice on security. The DS supports both TLS and SASL. TLS can be used for both authentication and encryption, and should therefore cover our security needs. SASL is quite new to me, and as of now I don't see the benefit of using it. Which security or functionality features does SASL provide that TLS doesn't? I know that SASL enables integration with Kerberos, but we're most likely not going for a Kerberos based solution. Furthermore, what are the default security features of RHDS 8.0? Is it using SASL by default (is it possible to deactivate it)? Regards, kenneho