diff --git a/main.go b/main.go
index 546a12b..b86920b 100644
--- a/main.go
+++ b/main.go
@@ -1776,14 +1776,15 @@ persistent_keepalive_interval=5`, util.FixKey(privateKey.String()), util.FixKey(
 
 		// Define the structure of the incoming message
 		type SSHCertData struct {
-			MessageId      int    `json:"messageId"`
-			AgentPort      int    `json:"agentPort"`
-			AgentHost      string `json:"agentHost"`
-			AuthDaemonMode string `json:"authDaemonMode"` // site, remote, native
-			CACert         string `json:"caCert"`
-			Username       string `json:"username"`
-			NiceID         string `json:"niceId"`
-			Metadata       struct {
+			MessageId          int    `json:"messageId"`
+			AgentPort          int    `json:"agentPort"`
+			AgentHost          string `json:"agentHost"`
+			ExternalAuthDaemon bool   `json:"externalAuthDaemon"`
+			AuthDaemonMode     string `json:"authDaemonMode"` // site, remote, native
+			CACert             string `json:"caCert"`
+			Username           string `json:"username"`
+			NiceID             string `json:"niceId"`
+			Metadata           struct {
 				SudoMode     string   `json:"sudoMode"`
 				SudoCommands []string `json:"sudoCommands"`
 				Homedir      bool     `json:"homedir"`
@@ -1805,9 +1806,15 @@ persistent_keepalive_interval=5`, util.FixKey(privateKey.String()), util.FixKey(
 			logger.Error("Error unmarshaling SSH cert data: %v", err)
 			return
 		}
+		var authDaemonMode = "site"
+		if certData.AuthDaemonMode != "" {
+			authDaemonMode = certData.AuthDaemonMode
+		} else if certData.ExternalAuthDaemon { // this is for backward compatibility with older server versions that don't send authDaemonMode
+			authDaemonMode = "remote"
+		}
 
 		// Use a switch statement for AuthDaemonMode
-		switch certData.AuthDaemonMode {
+		switch authDaemonMode {
 		case "site":
 			// Call ProcessConnection directly when running internally
 			logger.Debug("Calling internal auth daemon ProcessConnection for user %s", certData.Username)