diff --git a/kdc/krb5tgs.c b/kdc/krb5tgs.c
index 4ead67565..e8a3d1b37 100644
--- a/kdc/krb5tgs.c
+++ b/kdc/krb5tgs.c
@@ -1690,7 +1690,7 @@ tgs_build_reply(astgs_request_t priv,
 	    goto out;
         }
 
-	ret = verify_flags(context, config, &adtkt, spn);
+	ret = verify_flags(context, config, &adtkt, tpn);
 	if (ret) {
             _kdc_audit_addreason((kdc_request_t)priv,
                                  "User-to-user TGT expired or invalid");