---

sub {
  my $authByLDAP = shift;
  my $username = shift;
  my $requestPacket = shift;
  my $userObject = shift;

  my $EAPIdentity = $requestPacket->{EAPIdentity};
  my $outerIdentity = $requestPacket->{outerRequest}->{OriginalUserName};

  if (!defined($EAPIdentity) or ($EAPIdentity eq '')) {
    $EAPIdentity = $username.'@cesnet.cz';
  };

  if ( (defined($EAPIdentity) and defined($outerIdentity)) and
       ($EAPIdentity ne $outerIdentity) and
       ($outerIdentity ne 'anonymous@cesnet.cz')) {
    &main::log($main::LOG_DEBUG, "User $EAPIdentity/$outerIdentity is trying ".
      "cheat accounting. I disabled her/him. ;)");

    $userObject->{Check}->change_attr('User-Password',
      join('', ('.', '/', 0..9, 'A'..'Z', 'a'..'z')[rand 64, rand 64]));
    return 0;
  };
};