> diff --git a/src/responder/pam/pamsrv_cmd.c
b/src/responder/pam/pamsrv_cmd.c
> index
27dddcf43c1ff6eb465e1cb58d6dddf21413dcc4..978c637e22b03d3be1e07e8dc713aa01c4bb22e5 100644
> --- a/src/responder/pam/pamsrv_cmd.c
> +++ b/src/responder/pam/pamsrv_cmd.c
> @@ -957,11 +957,13 @@ static errno_t pam_forwarder_parse_data(struct cli_ctx *cctx,
struct pam_data *p
> } else {
> /* Only SSS_PAM_PREAUTH request may have a missing name, e.g. if the
> * name is determined with the help of a certificate */
> - if (pd->cmd == SSS_PAM_PREAUTH) {
> + if (pd->cmd == SSS_PAM_PREAUTH
> + &&
may_do_cert_auth(talloc_get_type(cctx->rctx->pvt_ctx,
> + struct pam_ctx),pd)) {
Since you might be touching the code again could you please fix this super minor nitpick
(missing space after comma)? Thanks!