diff --git a/src/nm-active-connection.c b/src/nm-active-connection.c
index 7ae6cf584c..4c77d45bb1 100644
--- a/src/nm-active-connection.c
+++ b/src/nm-active-connection.c
@@ -124,6 +124,8 @@ static void _settings_connection_flags_changed (NMSettingsConnection *settings_c
                                                 NMActiveConnection *self);
 static void _set_activation_type_managed (NMActiveConnection *self);
 
+static void auth_complete (NMActiveConnection *self, gboolean result, const char *message);
+
 /*****************************************************************************/
 
 #define _NMLOG_DOMAIN         LOGD_DEVICE
@@ -287,6 +289,10 @@ nm_active_connection_set_state (NMActiveConnection *self,
 	}
 
 	if (priv->state == NM_ACTIVE_CONNECTION_STATE_DEACTIVATED) {
+		_nm_unused gs_unref_object NMActiveConnection *self_keep_alive = g_object_ref (self);
+
+		auth_complete (self, FALSE, "Authorization request cancelled");
+
 		/* Device is no longer relevant when deactivated. So remove it and
 		 * emit property change notification so clients re-read the value,
 		 * which will be NULL due to conditions in get_property().
@@ -985,9 +991,11 @@ nm_active_connection_set_parent (NMActiveConnection *self, NMActiveConnection *p
 /*****************************************************************************/
 
 static void
-auth_cancel (NMActiveConnection *self)
+auth_complete (NMActiveConnection *self, gboolean result, const char *message)
 {
 	NMActiveConnectionPrivate *priv = NM_ACTIVE_CONNECTION_GET_PRIVATE (self);
+	NMActiveConnectionAuthResultFunc result_func;
+	gpointer user_data;
 
 	if (priv->auth.call_id_network_control)
 		nm_auth_manager_check_authorization_cancel (priv->auth.call_id_network_control);
@@ -997,21 +1005,26 @@ auth_cancel (NMActiveConnection *self)
 		else
 			nm_auth_manager_check_authorization_cancel (priv->auth.call_id_wifi_shared_permission);
 	}
-	priv->auth.result_func = NULL;
-	priv->auth.user_data = NULL;
+
+	nm_assert (!priv->auth.call_id_network_control);
+	nm_assert (!priv->auth.call_id_wifi_shared_permission);
+	if (priv->auth.result_func) {
+		result_func = g_steal_pointer (&priv->auth.result_func);
+		user_data = g_steal_pointer (&priv->auth.user_data);
+
+		result_func (self,
+		             result,
+		             message,
+		             user_data);
+	}
 }
 
 static void
-auth_complete (NMActiveConnection *self, gboolean result, const char *message)
+auth_complete_keep_alive (NMActiveConnection *self, gboolean result, const char *message)
 {
 	_nm_unused gs_unref_object NMActiveConnection *self_keep_alive = g_object_ref (self);
-	NMActiveConnectionPrivate *priv = NM_ACTIVE_CONNECTION_GET_PRIVATE (self);
 
-	priv->auth.result_func (self,
-	                        result,
-	                        message,
-	                        priv->auth.user_data);
-	auth_cancel (self);
+	auth_complete (self, result, message);
 }
 
 static void
@@ -1045,7 +1058,7 @@ auth_done (NMAuthManager *auth_mgr,
 	if (auth_call_id == priv->auth.call_id_network_control) {
 		priv->auth.call_id_network_control = NULL;
 		if (result != NM_AUTH_CALL_RESULT_YES) {
-			auth_complete (self, FALSE, "Not authorized to control networking.");
+			auth_complete_keep_alive (self, FALSE, "Not authorized to control networking.");
 			return;
 		}
 	} else {
@@ -1065,11 +1078,11 @@ auth_done (NMAuthManager *auth_mgr,
 
 	if (priv->auth.call_id_wifi_shared_permission) {
 		if (priv->auth.call_id_wifi_shared_permission == AUTH_CALL_ID_SHARED_WIFI_PERMISSION_FAILED)
-			auth_complete (self, FALSE, "Not authorized to share connections via wifi.");
+			auth_complete_keep_alive  (self, FALSE, "Not authorized to share connections via wifi.");
 		return;
 	}
 
-	auth_complete (self, TRUE, NULL);
+	auth_complete_keep_alive (self, TRUE, NULL);
 }
 
 /**
@@ -1421,7 +1434,7 @@ dispose (GObject *object)
 
 	_LOGD ("disposing");
 
-	auth_cancel (self);
+	auth_complete (self, FALSE, "Authorization aborted");
 
 	nm_clear_g_free (&priv->specific_object);