When are EXIM ACL's called?

Question

Having some trouble figuring out when exactly are the ACL's called in EXIM.

For example the acl_smtp_auth. Is it called before the AUTH command is verified(i.e. user and password authentication)? or after?

In the same example of acl_smtp_auth: Is it possible to know if the user was authenticated or not?

Note: I have put a custom ACL like this:

acl_smtp_auth = acl_check_auth

Answer 1

Exim ACL's are ran before the actual command is completed, but after the command syntax is verified.

For example for AUTH PLAIN, EXIM first checks if the the data is in correct Base64 and after that it runs the defined ACL. If the ACL accepts the AUTH it is processed.