diff --git a/kdc/kaserver.c b/kdc/kaserver.c
index f258bd333..0cf810e7f 100644
--- a/kdc/kaserver.c
+++ b/kdc/kaserver.c
@@ -451,8 +451,8 @@ do_authenticate (krb5_context context,
     }
 
     ret = _kdc_check_flags (context, config,
-			    &client_entry->entry, client_name,
-			    &server_entry->entry, server_name,
+			    client_entry, client_name,
+			    server_entry, server_name,
 			    TRUE);
     if (ret) {
 	make_error_reply (hdr, KAPWEXPIRED, reply);
@@ -747,8 +747,8 @@ do_getticket (krb5_context context,
     }
 
     ret = _kdc_check_flags (context, config, 
-			    &client_entry->entry, client_name,
-			    &server_entry->entry, server_name,
+			    client_entry, client_name,
+			    server_entry, server_name,
 			    FALSE);
     if (ret) {
 	make_error_reply (hdr, KAPWEXPIRED, reply);
diff --git a/kdc/kerberos4.c b/kdc/kerberos4.c
index 04d1c0829..bdf846954 100644
--- a/kdc/kerberos4.c
+++ b/kdc/kerberos4.c
@@ -200,8 +200,8 @@ _kdc_do_version4(krb5_context context,
 	}
 
 	ret = _kdc_check_flags (context, config, 
-				&client->entry, client_name,
-				&server->entry, server_name,
+				client, client_name,
+				server, server_name,
 				TRUE);
 	if (ret) {
 	    /* good error code? */
@@ -487,8 +487,8 @@ _kdc_do_version4(krb5_context context,
 	}
 
 	ret = _kdc_check_flags (context, config, 
-				&client->entry, client_name,
-				&server->entry, server_name,
+				client, client_name,
+				server, server_name,
 				FALSE);
 	if (ret) {
 	    /* good error code? */