--- loncom/auth/lonauth.pm	2017/08/08 18:12:18	1.146
+++ loncom/auth/lonauth.pm	2017/08/08 18:26:34	1.148
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # User Authentication Module
 #
-# $Id: lonauth.pm,v 1.146 2017/08/08 18:12:18 raeburn Exp $
+# $Id: lonauth.pm,v 1.148 2017/08/08 18:26:34 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -485,15 +485,15 @@ sub handler {
                     my $noprivswitch;
 #
 # su-user's home server and user's home server must have one of:
-# (a) same internet dom
-# (b) same primary library server for home server's domain
-# (c) same "internet domain" for primary library server for home server's domain
+# (a) same domain
+# (b) same primary library server for the two domains
+# (c) same "internet domain" for primary library server(s) for home servers' domains
 #
-                    my $uprim = &Apache::lonnet::domain($sudom,'primary');
-                    my $uintdom = &Apache::lonnet::internet_dom($uprim);
+                    my $suprim = &Apache::lonnet::domain($sudom,'primary');
+                    my $suintdom = &Apache::lonnet::internet_dom($suprim);
                     unless ($sudom eq $form{'udom'}) {
-                        my $suprim = &Apache::lonnet::domain($sudom,'primary');
-                        my $suintdom = &Apache::lonnet::internet_dom($suprim);
+                        my $uprim = &Apache::lonnet::domain($form{'udom'},'primary');
+                        my $uintdom = &Apache::lonnet::internet_dom($uprim);
                         unless ($suprim eq $uprim) {
                             unless ($suintdom eq $uintdom) {
                                 &Apache::lonnet::logthis('Attempted switch user '
@@ -510,7 +510,7 @@ sub handler {
 #
                         my $lonhost = $r->dir_config('lonHostID');
                         my $hostintdom = &Apache::lonnet::internet_dom($lonhost);
-                        if ($hostintdom ne $uintdom) {
+                        if ($hostintdom ne $suintdom) {
                             &Apache::lonnet::logthis('Attempted switch user on a '
                                 .'server with a different "internet domain".'); 
                         } else {