diff --git a/src/config.c b/src/config.c
index 90935722..bcf18e07 100644
--- a/src/config.c
+++ b/src/config.c
@@ -407,79 +407,75 @@ unsigned force_cert_auth;
 		prev = val;
 	} while((val = optionNextValue(pov, prev)) != NULL);
 
-	/* authentication information is only read on first load, as
-	 * it cannot be safely switched */
-	if (reload == 0) {
-		config->sup_config_type = SUP_CONFIG_FILE;
+	config->sup_config_type = SUP_CONFIG_FILE;
 
-		READ_MULTI_LINE("auth", auth, auth_size);
-		for (j=0;j<auth_size;j++) {
-			if (c_strncasecmp(auth[j], "pam", 3) == 0) {
-				config->auth_additional = get_brackets_string(config, auth[j]+3);
-				if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
-					fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
-					exit(1);
-				}
-#ifdef HAVE_PAM
-				config->auth_types |= amod->type;
-				amod = &pam_auth_funcs;
-#else
-				fprintf(stderr, "PAM support is disabled\n");
-				exit(1);
-#endif
-			} else if (strncasecmp(auth[j], "plain", 5) == 0) {
-				if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
-					fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
-					exit(1);
-				}
-
-				config->auth_additional = get_brackets_string(config, auth[j]+5);
-				if (config->auth_additional == NULL) {
-					fprintf(stderr, "Format error in %s\n", auth[j]);
-					exit(1);
-				}
-				amod = &plain_auth_funcs;
-				config->auth_types |= amod->type;
-			} else if (strncasecmp(auth[j], "radius", 6) == 0) {
-				const char *p;
-				if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
-					fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
-					exit(1);
-				}
-
-#ifdef HAVE_RADIUS
-				config->auth_additional = get_brackets_string1(config, auth[j]+6);
-				if (config->auth_additional == NULL) {
-					fprintf(stderr, "No configuration specified; error in %s\n", auth[j]);
-					exit(1);
-				}
-
-				p = get_brackets_string2(config, auth[j]+6);
-				if (p != NULL) {
-					if (strcasecmp(p, "groupconfig") != 0) {
-						fprintf(stderr, "No known configuration option: %s\n", p);
-						exit(1);
-					}
-					config->sup_config_type = SUP_CONFIG_RADIUS;
-				}
-				amod = &radius_auth_funcs;
-				config->auth_types |= amod->type;
-#else
-				fprintf(stderr, "Radius support is disabled\n");
-				exit(1);
-#endif
-			} else if (c_strcasecmp(auth[j], "certificate") == 0) {
-				config->auth_types |= AUTH_TYPE_CERTIFICATE;
-			} else if (c_strcasecmp(auth[j], "certificate[optional]") == 0) {
-				config->auth_types |= AUTH_TYPE_CERTIFICATE_OPT;
-			} else {
-				fprintf(stderr, "Unknown auth method: %s\n", auth[j]);
+	READ_MULTI_LINE("auth", auth, auth_size);
+	for (j=0;j<auth_size;j++) {
+		if (c_strncasecmp(auth[j], "pam", 3) == 0) {
+			config->auth_additional = get_brackets_string(config, auth[j]+3);
+			if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
+				fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
 				exit(1);
 			}
-			talloc_free(auth[j]);
+#ifdef HAVE_PAM
+			config->auth_types |= amod->type;
+			amod = &pam_auth_funcs;
+#else
+			fprintf(stderr, "PAM support is disabled\n");
+			exit(1);
+#endif
+		} else if (strncasecmp(auth[j], "plain", 5) == 0) {
+			if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
+				fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
+				exit(1);
+			}
+
+			config->auth_additional = get_brackets_string(config, auth[j]+5);
+			if (config->auth_additional == NULL) {
+				fprintf(stderr, "Format error in %s\n", auth[j]);
+				exit(1);
+			}
+			amod = &plain_auth_funcs;
+			config->auth_types |= amod->type;
+		} else if (strncasecmp(auth[j], "radius", 6) == 0) {
+			const char *p;
+			if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
+				fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
+				exit(1);
+			}
+
+#ifdef HAVE_RADIUS
+			config->auth_additional = get_brackets_string1(config, auth[j]+6);
+			if (config->auth_additional == NULL) {
+				fprintf(stderr, "No configuration specified; error in %s\n", auth[j]);
+				exit(1);
+			}
+
+			p = get_brackets_string2(config, auth[j]+6);
+			if (p != NULL) {
+				if (strcasecmp(p, "groupconfig") != 0) {
+					fprintf(stderr, "No known configuration option: %s\n", p);
+					exit(1);
+				}
+				config->sup_config_type = SUP_CONFIG_RADIUS;
+			}
+			amod = &radius_auth_funcs;
+			config->auth_types |= amod->type;
+#else
+			fprintf(stderr, "Radius support is disabled\n");
+			exit(1);
+#endif
+		} else if (c_strcasecmp(auth[j], "certificate") == 0) {
+			config->auth_types |= AUTH_TYPE_CERTIFICATE;
+		} else if (c_strcasecmp(auth[j], "certificate[optional]") == 0) {
+			config->auth_types |= AUTH_TYPE_CERTIFICATE_OPT;
+		} else {
+			fprintf(stderr, "Unknown auth method: %s\n", auth[j]);
+			exit(1);
 		}
-		talloc_free(auth);
+		talloc_free(auth[j]);
 	}
+	talloc_free(auth);
 
 	/* When adding allocated data, remember to modify
 	 * reload_cfg_file();
@@ -931,6 +927,7 @@ void print_version(tOptions *opts, tOptDesc *desc)
 void reload_cfg_file(void *pool, struct cfg_st* config)
 {
 	clear_cfg_file(config);
+
 	memset(config, 0, sizeof(*config));
 
 	parse_cfg_file(cfg_file, config, 1);
diff --git a/src/sec-mod-auth.c b/src/sec-mod-auth.c
index ebae25d5..b740f247 100644
--- a/src/sec-mod-auth.c
+++ b/src/sec-mod-auth.c
@@ -53,12 +53,22 @@
 
 static const struct auth_mod_st *module = NULL;
 
-void sec_auth_init(void *pool, struct cfg_st *config)
+void sec_auth_init(sec_mod_st * sec, struct cfg_st *config)
 {
 	module = get_auth_mod();
 
 	if (module && module->global_init) {
-		module->global_init(pool, config->auth_additional);
+		module->global_init(sec, config->auth_additional);
+	}
+}
+
+void sec_auth_reinit(sec_mod_st * sec, struct cfg_st *config)
+{
+	if (module) {
+		if (module != get_auth_mod()) {
+			seclog(sec, LOG_ERR, "Cannot change authentication method on reload");
+			exit(1);
+		}
 	}
 }
 
diff --git a/src/sec-mod.c b/src/sec-mod.c
index 9b3015dc..da4e1559 100644
--- a/src/sec-mod.c
+++ b/src/sec-mod.c
@@ -358,6 +358,7 @@ static void check_other_work(sec_mod_st *sec)
 	if (need_reload) {
 		seclog(sec, LOG_DEBUG, "reloading configuration");
 		reload_cfg_file(sec, sec->config);
+		sec_auth_reinit(sec, sec->config);
 		need_reload = 0;
 	}
 
diff --git a/src/sec-mod.h b/src/sec-mod.h
index cbc7a75e..45fc2d4d 100644
--- a/src/sec-mod.h
+++ b/src/sec-mod.h
@@ -89,7 +89,8 @@ void cleanup_client_entries(sec_mod_st *sec);
 	}
 #endif
 
-void sec_auth_init(void *pool, struct cfg_st *config);
+void sec_auth_init(sec_mod_st *sec, struct cfg_st *config);
+void sec_auth_reinit(sec_mod_st *sec, struct cfg_st *config);
 
 int handle_sec_auth_init(int cfd, sec_mod_st *sec, const SecAuthInitMsg * req);
 int handle_sec_auth_cont(int cfd, sec_mod_st *sec, const SecAuthContMsg * req);