diff --git a/src/auth/auth-request.c b/src/auth/auth-request.c
index b850fe0917..38315b1c74 100644
--- a/src/auth/auth-request.c
+++ b/src/auth/auth-request.c
@@ -408,10 +408,13 @@ bool auth_request_import_info(struct auth_request *request,
 		request->debug = TRUE;
 	else if (strcmp(key, "client_id") == 0)
 		request->client_id = p_strdup(request->pool, value);
-	else if (strcmp(key, "forward_fields") == 0)
+	else if (strcmp(key, "forward_fields") == 0) {
 		auth_fields_import_prefixed(request->extra_fields,
 					    "forward_", value, 0);
-	else
+		/* make sure the forward_ fields aren't deleted by
+		   auth_fields_rollback() if the first passdb lookup fails. */
+		auth_fields_snapshot(request->extra_fields);
+	} else
 		return FALSE;
 	/* NOTE: keep in sync with auth_request_export() */
 	return TRUE;