Auth

Libraries/Esiur/Security/Authority/Providers/PasswordAuthenticationHandler.cs

@@ -459,7 +459,10 @@ namespace Esiur.Security.Authority.Providers
                                                            .ToArray(), 512);
 
                         _step = -1;
-                        return new AuthenticationResult(AuthenticationRuling.Succeeded, null, _initiatorIdentity, _responderIdentity, sessionKey);
+                        // From the responder's perspective the authenticated initiator is
+                        // the remote identity. Keeping it in LocalIdentity makes a valid
+                        // client appear anonymous to server-side permission managers.
+                        return new AuthenticationResult(AuthenticationRuling.Succeeded, null, _responderIdentity, _initiatorIdentity, sessionKey);
 
                     }
                     else

Tests/Unit/AuthHandshakeTests.cs

@@ -118,6 +118,10 @@ public class AuthHandshakeTests
         Assert.NotNull(r3.SessionKey);
         Assert.Equal(64, r3.SessionKey.Length);      // 512-bit derived key
         Assert.Equal(r3.SessionKey, r4.SessionKey);  // both ends agree
+        Assert.Equal("alice", r3.LocalIdentity);
+        Assert.Null(r3.RemoteIdentity);
+        Assert.Null(r4.LocalIdentity);
+        Assert.Equal("alice", r4.RemoteIdentity);
     }
 
     [Fact]