diff --git a/Gopkg.lock b/Gopkg.lock
index 7624fbad..c30a68df 100644
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -37,7 +37,7 @@
     "ssh",
     "ssh/testdata"
   ]
-  revision = "daf7a6932c427819b72906700cd3e9209ec7d70e"
+  revision = "d47aa888633435f7d7af47a9b39ab3788b387f0c"
   source = "https://github.com/tg123/sshpiper.crypto"
 
 [solve-meta]
diff --git a/vendor/golang.org/x/crypto/ssh/sshpiper.go b/vendor/golang.org/x/crypto/ssh/sshpiper.go
index 23674ce4..c6f2f9d4 100644
--- a/vendor/golang.org/x/crypto/ssh/sshpiper.go
+++ b/vendor/golang.org/x/crypto/ssh/sshpiper.go
@@ -246,8 +246,6 @@ func NewSSHPiperConn(conn net.Conn, piper *SSHPiperConfig) (pipe *SSHPiperConn,
 
 	p.processAuthMsg = func(msg *userAuthRequestMsg) (*userAuthRequestMsg, error) {
 
-		msg.User = mappedUser
-
 		var authType AuthPipeType = AuthPipeTypePassThrough
 		var authMethod AuthMethod
 
@@ -318,9 +316,10 @@ func NewSSHPiperConn(conn net.Conn, piper *SSHPiperConfig) (pipe *SSHPiperConn,
 
 		switch authType {
 		case AuthPipeTypePassThrough:
+			msg.User = mappedUser
 			return msg, nil
 		case AuthPipeTypeDiscard:
-			return msg, nil
+			return nil, nil
 		case AuthPipeTypeNone:
 			return noneAuthMsg(mappedUser), nil
 		case AuthPipeTypeMap:
@@ -339,8 +338,7 @@ func NewSSHPiperConn(conn net.Conn, piper *SSHPiperConfig) (pipe *SSHPiperConn,
 
 			signers, err := f()
 			// no mapped user change it to none or error occur
-			//if err != nil || len(signers) == 0 {
-			if err != nil {
+			if err != nil || len(signers) == 0 {
 				return nil, err
 			}
 
@@ -349,6 +347,7 @@ func NewSSHPiperConn(conn net.Conn, piper *SSHPiperConfig) (pipe *SSHPiperConn,
 				if err != nil {
 					return nil, err
 				}
+				return msg, nil
 			}
 		case "password":
 
@@ -385,6 +384,7 @@ func NewSSHPiperConn(conn net.Conn, piper *SSHPiperConfig) (pipe *SSHPiperConn,
 
 		}
 
+		msg.User = mappedUser
 		return msg, nil
 	}
 
diff --git a/vendor/golang.org/x/crypto/ssh/sshpiper_test.go b/vendor/golang.org/x/crypto/ssh/sshpiper_test.go
index 0c30ea3f..b36a236c 100644
--- a/vendor/golang.org/x/crypto/ssh/sshpiper_test.go
+++ b/vendor/golang.org/x/crypto/ssh/sshpiper_test.go
@@ -411,6 +411,87 @@ func TestPiperServerWithBanner(t *testing.T) {
 	}
 }
 
+func TestPiperUsernameNotChangedWithinSession(t *testing.T) {
+	const mappedname = "mappedname"
+
+	callcount := 0
+
+	certChecker := CertChecker{
+		IsUserAuthority: func(k PublicKey) bool {
+			return bytes.Equal(k.Marshal(), testPublicKeys["ecdsa"].Marshal())
+		},
+		UserKeyFallback: func(conn ConnMetadata, key PublicKey) (*Permissions, error) {
+			if bytes.Equal(key.Marshal(), testPublicKeys["rsa"].Marshal()) {
+				return nil, nil
+			}
+
+			return nil, fmt.Errorf("pubkey for %q not acceptable", conn.User())
+		},
+		IsRevoked: func(c *Certificate) bool {
+			return c.Serial == 666
+		},
+	}
+
+	c, err := dialPiper(&SSHPiperConfig{
+		FindUpstream: func(conn ConnMetadata) (net.Conn, *SSHPiperAuthPipe, error) {
+			s, err := dialUpstream(simpleEchoHandler, &ServerConfig{
+				PasswordCallback: func(conn ConnMetadata, password []byte) (*Permissions, error) {
+					if conn.User() != mappedname {
+						t.Errorf("bad mapped username")
+					}
+
+					return nil, fmt.Errorf("access denied")
+				},
+				PublicKeyCallback: func(conn ConnMetadata, key PublicKey) (*Permissions, error) {
+					if conn.User() != mappedname {
+						t.Errorf("bad mapped username")
+					}
+
+					return certChecker.Authenticate(conn, key)
+				},
+				AuthLogCallback: func(conn ConnMetadata, method string, err error) {
+					if conn.User() != mappedname {
+						t.Errorf("bad mapped username")
+					}
+
+					callcount += 1
+				},
+			}, t)
+			return s, &SSHPiperAuthPipe{
+				User: mappedname,
+
+				PublicKeyCallback: func(conn ConnMetadata, key PublicKey) (AuthPipeType, AuthMethod, error) {
+					return AuthPipeTypeMap, PublicKeys(testSigners["rsa"]), nil
+				},
+
+				UpstreamHostKeyCallback: InsecureIgnoreHostKey(),
+			}, err
+		},
+	})
+
+	if err != nil {
+		t.Fatalf("connect dial to piper: %v", err)
+	}
+
+	_, _, _, err = NewClientConn(c, "", &ClientConfig{
+		User: "testuser",
+		Auth: []AuthMethod{
+			AuthMethod(new(noneAuth)),
+			Password("badpassword"),
+			PublicKeys(testSigners["rsa"]),
+		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
+	})
+
+	if err != nil {
+		t.Fatalf("can connect to piper %v", err)
+	}
+
+	if callcount != 3 {
+		t.Fatalf("some auth not called")
+	}
+}
+
 func TestPiperAdditionalChallenge(t *testing.T) {
 	c, err := dialPiper(&SSHPiperConfig{
 		AdditionalChallenge: func(conn ConnMetadata, challenge KeyboardInteractiveChallenge) (bool, error) {