--- ,session.c	Sat Jul 17 02:05:14 2004
+++ session.c	Mon Aug 16 16:57:53 2004
@@ -661,14 +661,6 @@
 		debug("Forced command '%.900s'", command);
 	}
 
-#ifdef GSSAPI
-	if (options.gss_authentication) {
-		temporarily_use_uid(s->pw);
-		ssh_gssapi_storecreds();
-		restore_uid();
-	}
-#endif
-
 	if (s->ttyfd != -1)
 		do_exec_pty(s, command);
 	else
@@ -1247,6 +1239,13 @@
 # ifdef __bsdi__
 		setpgid(0, 0);
 # endif
+#ifdef GSSAPI
+	if (options.gss_authentication) {
+		temporarily_use_uid(pw);
+		ssh_gssapi_storecreds();
+		restore_uid();
+	}
+#endif
 # ifdef USE_PAM
 		if (options.use_pam) {
 			do_pam_session();
@@ -1277,6 +1276,13 @@
 			exit(1);
 		}
 		endgrent();
+#ifdef GSSAPI
+	if (options.gss_authentication) {
+		temporarily_use_uid(pw);
+		ssh_gssapi_storecreds();
+		restore_uid();
+	}
+#endif
 # ifdef USE_PAM
 		/*
 		 * PAM credentials may take the form of supplementary groups.
