}
	}

internalAuth:
	ui, ok := globalIAMSys.GetUser(context.Background(), user)
	if !ok {
		return nil, errNoSuchUser
	}

	if globalSFTPTrustedCAPubkey != nil && pass == nil {
		err := validateClientKeyIsTrusted(c, key)
		if err != nil {
			return nil, errAuthentication
		}
	} else {
		// Temporary credentials are not allowed.
		if ui.Credentials.IsTemp() {
			return nil, errAuthentication
		}