@@ -57,7 +57,7 @@ int impl::authenticate (const pam_request &request)

 {

     conversation_result input (conversation_.initiate (request));

-    int auth_result = validator_.validate (input.user_name,

+    int auth_result = validator_.validate ("", input.user_name,

                                            input.token) ? PAM_SUCCESS : PAM_AUTH_ERR;

     logger_.log (auth_result, input.user_name, input.token);

@@ -26,10 +26,15 @@ public:

           const user_token_supplier user_token_supplier) :

         directory_ (directory),

         user_token_supplier_ (user_token_supplier) {}

-    bool validate (const std::string &user_name,

+    bool validate (const std::string &requester_user_name,

+                   const std::string &authorizer_user_name,

                    const std::string &token)

     {

-        std::vector<user> found_user = directory_.find_user (user_name);

+        std::vector<user> found_user = directory_.find_user (authorizer_user_name);

+

+        if (requester_user_name == authorizer_user_name) {

+            return false;

+        }

         if (found_user.empty()) {

             return false;

@@ -22,8 +22,9 @@ class validator_ifc

 {

 public:

     virtual ~validator_ifc() {}

-    virtual bool validate (const std::string &user_name,

-                           const std::string &token)

+    virtual bool validate (const std::string &requester_user_name,

+                           const std::string &authorizer_user_name,

+                           const std::string &authorizer_token)

     {

         return false;

     }

@@ -38,9 +39,9 @@ public:

         (delegate) {}

     validator() : validator (std::shared_ptr<validator_ifc>

                                  (new validator_ifc)) {}

-    bool validate (const std::string &user_name, const std::string &token)

+    bool validate (const std::string &requester_user_name, const std::string &authorizer_user_name, const std::string &authorizer_token)

     {

-        return delegate_->validate (user_name, token);

+        return delegate_->validate (requester_user_name, authorizer_user_name, authorizer_token);

     }

     static validator create (const directory &directory,

                              const user_token_supplier &token_supplier);

@@ -70,7 +70,7 @@ bool validator_validates()

     validator validator = validator::create (directory, user_token_supplier);

     // when

-    bool actual = validator.validate (user_name, token);

+    bool actual = validator.validate ("requester", user_name, token);

     // then

     check (actual, "should be valid");

@@ -88,7 +88,7 @@ bool validator_fails_unknown_user()

     validator validator = validator::create (directory, user_token_supplier);

     // when

-    bool actual = validator.validate ("notuser", token);

+    bool actual = validator.validate ("requester", "notuser", token);

     // then

     check (!actual, "should not be valid");

@@ -106,13 +106,32 @@ bool validator_fails_incorrect_token()

     validator validator = validator::create (directory, user_token_supplier);

     // when

-    bool actual = validator.validate (user_name, "token");

+    bool actual = validator.validate ("requester", user_name, "token");

     // then

     check (!actual, "should not be valid");

     succeed();

 }

+bool validator_fails_with_own_token() {

+    // given

+    std::string requester_user_name("requester");

+    std::string authorizer_user_name(requester_user_name);

+    std::string authorizer_token("token");

+    directory directory (share (new fake_directory (authorizer_user_name)));

+    user_token_supplier user_token_supplier (share (new

+            fake_user_token_supplier(authorizer_token)));

+    validator validator = validator::create (directory, user_token_supplier);

+

+    // when

+    bool actual = validator.validate (requester_user_name, authorizer_user_name, authorizer_token);

+

+    // then

+    check(!actual, "should not be valid");

+    succeed();

+

+}

+

 RESET_VARS_START

 RESET_VARS_END

@@ -121,6 +140,7 @@ bool run_tests()

     test (validator_validates);

     test (validator_fails_unknown_user);

     test (validator_fails_incorrect_token);

+    test (validator_fails_with_own_token);

     succeed();

 }