coretasks: fix SASL EXTERNAL without password set

sopel/coretasks.py

@@ -107,9 +107,9 @@ def _handle_sasl_capability(
         )
         return plugin.CapabilityNegotiation.ERROR
 
-    # Check SASL configuration (password is required)
+    # Check SASL configuration (password is required for PLAIN/SCRAM)
     password, mech = _get_sasl_pass_and_mech(bot)
-    if not password:
+    if mech != "EXTERNAL" and not password:
         raise config.ConfigurationError(
             'SASL authentication required but no password available; '
             'please check your configuration file.',

test/coretasks/test_coretasks_sasl.py

@@ -253,6 +253,26 @@ def test_sasl_plain_no_password(
     ), 'No password is a configuration error and the bot must quit.'
 
 
+# https://github.com/sopel-irc/sopel/issues/2560
+def test_sasl_external_no_password(
+    botfactory: BotFactory,
+    configfactory: ConfigFactory,
+) -> None:
+    tmpconfig = configfactory("conf.ini", TMP_CONFIG_SASL_NO_PASSWORD)
+    mockbot = botfactory.preloaded(tmpconfig, preloads=["coretasks"])
+    mockbot.settings.core.auth_target = "EXTERNAL"
+    mockbot.backend.connected = True
+
+    # connect and capability negotiation
+    mockbot.on_connect()
+    mockbot.on_message(":irc.example.com CAP * LS :sasl=PLAIN,EXTERNAL")
+    n = len(mockbot.backend.message_sent)
+    mockbot.on_message(":irc.example.com CAP * ACK :sasl")
+    assert mockbot.backend.message_sent[n:] == rawlist(
+        "AUTHENTICATE EXTERNAL"
+    ), "SASL EXTERNAL did not continue without a password configured."
+
+
 def test_sasl_plain_bad_password(botfactory: BotFactory, tmpconfig) -> None:
     mockbot = botfactory.preloaded(tmpconfig, preloads=['coretasks'])
     mockbot.backend.connected = True