--- /cvs/drupal/contributions/modules/shib_auth/shib_auth.module	2009/09/30 17:00:49	1.3.4.5.2.31
+++ /cvs/drupal/contributions/modules/shib_auth/shib_auth.module	2010/01/07 15:06:36	1.3.4.5.2.32
@@ -1,5 +1,5 @@
 <?php
-// $Id: shib_auth.module,v 1.3.4.5.2.30 2009/09/21 14:18:34 bajnokk Exp $
+// $Id: shib_auth.module,v 1.3.4.5.2.31 2009/09/30 17:00:49 bajnokk Exp $
 /**
  * @file
  * This is a Shibboleth authentication module.
@@ -66,22 +66,23 @@
     session_destroy();
     $user = drupal_anonymous_user();
   }
+  // Ensure that the user is the same as the one who has initiated the session
+  elseif (isset($_SESSION['uname'])) {
+    if ($_SESSION['uname'] != $uname) { 
+      unset($_SESSION['authentication']);
+      unset($_SESSION['uname']);
+      session_destroy();
+      $user = drupal_anonymous_user();
+    }
+  }
+  else {
+      $_SESSION['uname'] = $uname;
+  }
 
   $uname = $_SERVER[variable_get('shib_auth_username_variable', 'REMOTE_USER')];
   $umail= $_SERVER[variable_get('shib_auth_username_email', 'HTTP_SHIB_MAIL')];
   $umail_single = preg_replace('/;.*/', '', $umail);
 
-  // Ensure that the user is the same as the one who has initiated the session
-  if (isset($_SESSION['uname'])) {
-	  if ($_SESSION['uname'] != $uname) { 
-		  unset($_SESSION['authentication']);
-		  unset($_SESSION['uname']);
-		  session_destroy();
-		  $user = drupal_anonymous_user();
-	  }
-  } else {
-	  $_SESSION['uname'] = $uname;
-  }
 
   // If
   // - The user isn't logged in
@@ -256,7 +257,7 @@
     }
     drupal_goto("$logouthandler?return=$logout_redirect");
   }
-  else if ($op == "delete") {
+  elseif ($op == "delete") {
     db_query("DELETE FROM {authmap} WHERE uid = %d AND authname = '%s' AND module = 'shib_auth'",
             $account->uid, $account->name);
   }