diff --git a/Libraries/Esiur/Security/Authority/Providers/PasswordAuthenticationHandler.cs b/Libraries/Esiur/Security/Authority/Providers/PasswordAuthenticationHandler.cs
index 7d5d4d4..b406964 100644
--- a/Libraries/Esiur/Security/Authority/Providers/PasswordAuthenticationHandler.cs
+++ b/Libraries/Esiur/Security/Authority/Providers/PasswordAuthenticationHandler.cs
@@ -459,7 +459,10 @@ namespace Esiur.Security.Authority.Providers
                                                            .ToArray(), 512);
 
                         _step = -1;
-                        return new AuthenticationResult(AuthenticationRuling.Succeeded, null, _initiatorIdentity, _responderIdentity, sessionKey);
+                        // From the responder's perspective the authenticated initiator is
+                        // the remote identity. Keeping it in LocalIdentity makes a valid
+                        // client appear anonymous to server-side permission managers.
+                        return new AuthenticationResult(AuthenticationRuling.Succeeded, null, _responderIdentity, _initiatorIdentity, sessionKey);
 
                     }
                     else
diff --git a/Tests/Unit/AuthHandshakeTests.cs b/Tests/Unit/AuthHandshakeTests.cs
index a9299a2..037a839 100644
--- a/Tests/Unit/AuthHandshakeTests.cs
+++ b/Tests/Unit/AuthHandshakeTests.cs
@@ -118,6 +118,10 @@ public class AuthHandshakeTests
         Assert.NotNull(r3.SessionKey);
         Assert.Equal(64, r3.SessionKey.Length);      // 512-bit derived key
         Assert.Equal(r3.SessionKey, r4.SessionKey);  // both ends agree
+        Assert.Equal("alice", r3.LocalIdentity);
+        Assert.Null(r3.RemoteIdentity);
+        Assert.Null(r4.LocalIdentity);
+        Assert.Equal("alice", r4.RemoteIdentity);
     }
 
     [Fact]