diff --git a/client/src/main/java/org/apache/qpid/client/handler/ConnectionStartMethodHandler.java b/client/src/main/java/org/apache/qpid/client/handler/ConnectionStartMethodHandler.java
index 56ac655..13ac6c6 100644
--- a/client/src/main/java/org/apache/qpid/client/handler/ConnectionStartMethodHandler.java
+++ b/client/src/main/java/org/apache/qpid/client/handler/ConnectionStartMethodHandler.java
@@ -21,6 +21,8 @@
 package org.apache.qpid.client.handler;
 
 import java.io.UnsupportedEncodingException;
+import java.util.Collections;
+import java.util.Map;
 import java.util.StringTokenizer;
 
 import javax.security.sasl.Sasl;
@@ -46,6 +48,7 @@
 import org.apache.qpid.framing.ProtocolVersion;
 import org.apache.qpid.jms.ConnectionURL;
 import org.apache.qpid.properties.ConnectionStartProperties;
+import org.apache.qpid.transport.ConnectionSettings;
 
 public class ConnectionStartMethodHandler implements StateAwareMethodListener<ConnectionStartBody>
 {
@@ -97,6 +100,7 @@
             {
                 // Used to hold the SASL mechanism to authenticate with.
                 String mechanism;
+                final ConnectionSettings connectionSettings = session.getAMQConnection().getConnectionSettings();
 
                 if (body.getMechanisms()== null)
                 {
@@ -104,7 +108,8 @@
                 }
                 else
                 {
-                    mechanism = chooseMechanism(body.getMechanisms());
+                    String restriction = connectionSettings.getSaslMechs();
+                    mechanism = chooseMechanism(body.getMechanisms(), restriction);
                     _log.debug("mechanism = " + mechanism);
                 }
 
@@ -116,8 +121,24 @@
                 byte[] saslResponse;
                 try
                 {
+                    final Map<String, ?> saslProps;
+                    if (connectionSettings.isUseSASLEncryption())
+                    {
+                        saslProps = Collections.singletonMap(Sasl.QOP, "auth-conf");
+                    }
+                    else
+                    {
+                        saslProps = null;
+                    }
+
+                    String saslProtocol = connectionSettings.getSaslProtocol();
+                    String saslServerName = connectionSettings.getSaslServerName();
+                    if(saslServerName == null)
+                    {
+                        saslServerName = connectionSettings.getHost();
+                    }
                     SaslClient sc =
-                        Sasl.createSaslClient(new String[] { mechanism }, null, "AMQP", "localhost", null,
+                        Sasl.createSaslClient(new String[] { mechanism }, null, saslProtocol, saslServerName, saslProps,
                             createCallbackHandler(mechanism, session));
                     if (sc == null)
                     {
@@ -198,10 +219,10 @@
         }
     }
 
-    private String chooseMechanism(byte[] availableMechanisms) throws UnsupportedEncodingException
+    private String chooseMechanism(byte[] availableMechanisms, final String restriction) throws UnsupportedEncodingException
     {
         final String mechanisms = new String(availableMechanisms, "utf8");
-        return CallbackHandlerRegistry.getInstance().selectMechanism(mechanisms);
+        return CallbackHandlerRegistry.getInstance().selectMechanism(mechanisms, restriction);
     }
 
     private AMQCallbackHandler createCallbackHandler(String mechanism, AMQProtocolSession protocolSession)
diff --git a/doc/jms-client-0-8/src/docbkx/JMS-Client-Connection-URL.xml b/doc/jms-client-0-8/src/docbkx/JMS-Client-Connection-URL.xml
index 96b9e3a..7bc179f 100644
--- a/doc/jms-client-0-8/src/docbkx/JMS-Client-Connection-URL.xml
+++ b/doc/jms-client-0-8/src/docbkx/JMS-Client-Connection-URL.xml
@@ -243,17 +243,15 @@
 							supported.</para>
 					</entry>
 				</row>
-				<!-- 0-10 only
 				<row>
 					<entry> sasl_mechs </entry>
 					<entry> - </entry>
-					<entry> For secure applications, we suggest CRAM-MD5, DIGEST-MD5, or GSSAPI. The
-						ANONYMOUS method is not secure. The PLAIN method is secure only when used
-						together with SSL. For Kerberos, sasl_mechs must be set to GSSAPI,
-						sasl_protocol must be set to the principal for the qpidd broker, e.g.
-						qpidd/, and sasl_server must be set to the host for the SASL server, e.g.
-						sasl.com. SASL External is supported using SSL certification, e.g.
-							<literal>ssl='true'&amp;sasl_mechs='EXTERNAL'</literal>
+					<entry> A comma separated list of SASL mechanisms which may be used.  If not present then
+						any method offered by the broker may be used.
+						For secure applications, we suggest SCRAM-SHA-256. The
+						ANONYMOUS mechanism is not secure. The PLAIN mechanism is secure only when used
+						together with SSL. SASL External is supported using SSL certification, e.g.
+						<literal>ssl='true'&amp;sasl_mechs='EXTERNAL'</literal>
 					</entry>
 				</row>
 				<row>
@@ -274,10 +272,9 @@
 				<row>
 					<entry> sasl_server </entry>
 					<entry> - </entry>
-					<entry> For Kerberos, sasl_mechs must be set to GSSAPI, sasl_server must be set
+					<entry> For Kerberos, sasl_server must be set
 						to the host for the SASL server, e.g. <literal>sasl.com</literal>. </entry>
 				</row>
-				-->
 				<row>
 					<entry> ssl </entry>
 					<entry> Boolean </entry>
diff --git a/doc/jms-client-0-8/src/docbkx/JMS-Client-System-Properties.xml b/doc/jms-client-0-8/src/docbkx/JMS-Client-System-Properties.xml
index 8c2fb93..59657bc 100644
--- a/doc/jms-client-0-8/src/docbkx/JMS-Client-System-Properties.xml
+++ b/doc/jms-client-0-8/src/docbkx/JMS-Client-System-Properties.xml
@@ -432,12 +432,13 @@
 						<para>It is only applicable for AMQP 0-8/0-9/0-9-1 clients.</para>
 					</entry>
 				</row>
+
+
 			</tbody>
 		</tgroup>
 	</table>
 
-	<!-- These are all 0-10 related
-    <table pgwide="1">
+	<table pgwide="1">
 		<title>Config Options For Security</title>
 		<tgroup cols="4">
 			<thead>
@@ -449,39 +450,39 @@
 				</row>
 			</thead>
 			<tbody>
-				
 				<row>
 					<entry>qpid.sasl_mechs</entry>
 					<entry>string</entry>
-					<entry>PLAIN</entry>
-					<entry><para>The SASL mechanism to be used. More than one could be specified as
-							a comma separated list.</para><para>We currently support the following
-							mechanisms {PLAIN | GSSAPI | EXTERNAL}.</para><para>This can also be set
-							per connection using the <link linkend="JMS-Client-0-8-Connection-URL"
-								>Connection URL</link> options.</para></entry>
+					<entry></entry>
+					<entry><para>Restriction on the SASL mechanisms which can be used.
+						More than one could be specified as
+						a comma separated list.</para><para>We currently support the following
+						mechanisms {PLAIN | GSSAPI | EXTERNAL}.</para><para>This can also be set
+						per connection using the
+						<link linkend="JMS-Client-0-8-Connection-URL">Connection URL</link> options.</para>
+					</entry>
 				</row>
-
 				<row>
 					<entry>qpid.sasl_protocol</entry>
 					<entry>string</entry>
 					<entry>AMQP</entry>
 					<entry><para>When using GSSAPI as the SASL mechanism,
-								<varname>sasl_protocol</varname> must be set to the principal for
-							the qpidd broker, e.g. <varname>qpidd</varname>.</para><para>This can
-							also be set per connection using the <link
+						<varname>sasl_protocol</varname> must be set to the principal for
+						the qpid broker, e.g. <varname>qpidd</varname>.</para><para>This can
+						also be set per connection using the <link
 								linkend="JMS-Client-0-8-Connection-URL">Connection URL</link>
-							options.</para></entry>
+						options.</para></entry>
 				</row>
 				<row>
 					<entry>qpid.sasl_server_name</entry>
 					<entry>string</entry>
 					<entry>localhost</entry>
 					<entry><para>When using GSSAPI as the SASL mechanism,
-								<varname>sasl_server</varname> must be set to the host for the SASL
-							server, e.g. <varname>example.com</varname>.</para><para>This can also
-							be set per connection using the <link
+						<varname>sasl_server</varname> must be set to the host for the SASL
+						server, e.g. <varname>example.com</varname>.</para><para>This can also
+						be set per connection using the <link
 								linkend="JMS-Client-0-8-Connection-URL">Connection URL</link>
-							options.</para></entry>
+						options.</para></entry>
 				</row>
 			</tbody>
 		</tgroup>
@@ -529,7 +530,7 @@
 			</tbody>
 		</tgroup>
 	</table>
-	-->
+
 	<table pgwide="1">
 		<title>Config Options For Security - Using SSL for securing connections or using EXTERNAL as
 			the SASL mechanism.</title>