If the client knows instead a DN and password, then it should a
mechanism intended for DN/password authentication (such as
Simple bind over TLS).
From an interoperability perspective this has problems as a server is
only required to implement DIGEST-MD5 and simple authentication, not
TLS. This theoretical client would then only be able to interwork with
servers which implement TLS or would be forced to use a less secure
authentication mechanism (simple bind without TLS). This seems counter
to the reasons in RFC2829 and [authmeth] for introducing SASL
mechanisms, in particular, SASL DIGEST-MD5.