diff --git a/CHANGES b/CHANGES
index ab09f147bb5c6dd34af63f489ce06181fda71b8b..8ec6ea2a47ed24b5e4720ebf436936f93efcda36 100644
--- a/CHANGES
+++ b/CHANGES
@@ -10,6 +10,7 @@ OpenLDAP 2.4.22 Engineering
 	Fixed slapd ignore controls with unrecognized flags (ITS#6480)
 	Fixed slapd REP_ENTRY flag handling (ITS#5340)
 	Fixed slapd sasl auxprop_lookup (ITS#6441)
+	Fixed slapd sasl auxprop ssf (ITS#5195)
 	Fixed slapd syncrepl for unknown attrs and delta-sync (ITS#6473)
 	Fixed slapd-bdb contextCSN updates from updatedn (ITS#6469)
 	Fixed slapo-collect REP_ENTRY flag handling (ITS#5340,ITS#6423)
diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c
index 34fa3c8b53926e55f1ac5d66e009e840d38b8d37..fd25cf363fada1b5aa517740b530a46013a2e937 100644
--- a/servers/slapd/sasl.c
+++ b/servers/slapd/sasl.c
@@ -404,6 +404,7 @@ slap_auxprop_lookup(
 				op->ors_slimit = 1;
 				op->ors_filter = &generic_filter;
 				op->ors_filterstr = generic_filterstr;
+				op->o_authz = conn->c_authz;
 				/* FIXME: we want all attributes, right? */
 				op->ors_attrs = NULL;