diff --git a/downstream.go b/downstream.go
index b185b04..90767fa 100644
--- a/downstream.go
+++ b/downstream.go
@@ -918,6 +918,9 @@ func (dc *downstreamConn) handleAuthenticate(msg *irc.Message) (result *downstre
 		switch mech {
 		case "PLAIN":
 			server = sasl.NewPlainServer(sasl.PlainAuthenticator(func(identity, username, password string) error {
+				if identity != "" && identity != username {
+					return fmt.Errorf("SASL PLAIN identity not supported")
+				}
 				dc.sasl.plain = &saslPlain{
 					Username: username,
 					Password: password,