[Exim] multiple domain lookups with CRAM-MD5 authentication

I'm trying to do 3 different lookups to get the server_secret within an
cram_md5 driver,

i've tried -
${lookup mysql{select upasswd from db1.table1 where email='$1'} {$value} \
{${lookup mysql{select upasswd from db1.table2 where domain='$1'} {$value} \
{ ${lookup mysql{select password from db2.table1 where user='$1'} {$value}
fail}}}}} "
which returns a valid lookup,
"lookup yielded: 123456"
but reports -
"Authentication failed for (fern.vianetworks.co.uk) [195.102.252.191]: 535
Incorrect authentication data"

and

${lookup mysql{select password from db2.table1md5 where user='$1'}
${if or \
{${if def:value ${lookup mysql{select upasswd from db1.table1 where
email='$1'} }fail}}\
{${if def:value ${lookup mysql{select upasswd from db1.table2 where
domain='$1'} }fail}}\
{${if def:value ${lookup mysql{select password from db2.table1 where
user='$1'} }fail}}\
{$value}{no}}"

which gives me, "435 Unable to authenticate at present: subcondition in {}
expected inside "or{...}" condition", however i thought
{${if def:value ${lookup mysql{select upasswd from db1.table1 where
email='$1'}}fail}} would be classed as a subcondition, or am i getting
confused there?


Can anyone shed some light on this,
I'm running exim as - /opt/exim/bin/exim -bd -d9
which gives -
"Exim version 3.22 debug level 9 uid=0 gid=1"

can anyone help?

Colin Morey,