On Feb 20, 2013, at 9:10 PM, Russ Allbery wrote: > Ah, but the WebKDC doesn't special-case the authz_subject in that case! > So you get an error if you actually try to assert that identity.
That's what I was running into, and my thinking at the time was to allow the explicit assertion so that a WAS using the WEBAUTH_AUTHZ_USER environment variable would function consistently. I think that this is a better approach, however. Thank you for the fix. Ben
