fix(sspi): don't split UPNs into username/domain

proptest-regressions/auth_identity.txt

@@ -8,3 +8,4 @@ cc 22a32450b3cada4bb46952cb5109e3b305e8c756d58d37136a195c3bc3dee4cb # shrinks to
 cc 7f7cdbd18aad0a1d970b6ff9ce7fbfaa7e4dabeb0b55cca0c7f7610f8f0e3cbf # shrinks to value = "A@\\.a"
 cc f946f1001aacc60322cba7ba063fa386f4e0c6d9497d8144e300f8b4652e378e # shrinks to value = "A\\a\\a"
 cc 033e00adafc5d7bc9402013f261b9f7de65938d4ce9f66f2ea4ec1419a0ae286 # shrinks to value = "A@0@a"
+cc 00006d40d3bad9fbb82517e5177c07b60ca9baf0b12210f6c26c52166b6c1b26 # shrinks to value = "0\\AA"

src/auth_identity.rs

@@ -110,32 +110,30 @@ impl Username {
     }
 
     /// Returns the internal representation, as-is
-    pub fn inner(&self) -> &str {
+    pub(crate) fn inner(&self) -> &str {
         &self.value
     }
 
     /// Returns the [`UserNameFormat`] for this username
-    pub fn format(&self) -> UserNameFormat {
+    pub(crate) fn format(&self) -> UserNameFormat {
         self.format
     }
 
-    /// May return an UPN suffix or NetBIOS domain name depending on the internal format
-    pub fn domain_name(&self) -> Option<&str> {
-        self.sep_idx.map(|idx| match self.format {
-            UserNameFormat::UserPrincipalName => &self.value[idx + 1..],
-            UserNameFormat::DownLevelLogonName => &self.value[..idx],
-        })
+    /// May return None or NetBIOS domain name depending on the internal format
+    pub(crate) fn domain_name(&self) -> Option<&str> {
+        match self.format() {
+            UserNameFormat::DownLevelLogonName => self.sep_idx.map(|idx| &self.value[..idx]),
+            UserNameFormat::UserPrincipalName => None,
+        }
     }
 
     /// Returns the account name
-    pub fn account_name(&self) -> &str {
-        if let Some(idx) = self.sep_idx {
-            match self.format {
-                UserNameFormat::UserPrincipalName => &self.value[..idx],
-                UserNameFormat::DownLevelLogonName => &self.value[idx + 1..],
+    pub(crate) fn account_name(&self) -> &str {
+        match self.format() {
+            UserNameFormat::DownLevelLogonName => {
+                self.sep_idx.map(|idx| &self.value[idx + 1..]).unwrap_or(self.inner())
             }
-        } else {
-            &self.value
+            UserNameFormat::UserPrincipalName => self.inner(),
         }
     }
 }
@@ -438,9 +436,11 @@ mod tests {
             assert_eq!(initial_username.inner(), value);
 
             if let Some(domain_name) = initial_username.domain_name() {
-                let upn = Username::new_upn(initial_username.account_name(), domain_name).expect("UPN");
-                assert_eq!(upn.account_name(), initial_username.account_name());
-                assert_eq!(upn.domain_name(), initial_username.domain_name());
+                let account_name = initial_username.account_name();
+                let upn = Username::new_upn(account_name, domain_name).expect("UPN");
+
+                assert_eq!(upn.account_name(), format!("{account_name}@{domain_name}"));
+                assert_eq!(upn.domain_name(), None);
             }
 
             // A down-level user name can’t contain a @ in the account name
@@ -463,8 +463,8 @@ mod tests {
         proptest!(|(account_name in "[a-zA-Z0-9@.]{1,3}", domain_name in "[a-z0-9.]{1,3}")| {
             let username = Username::new_upn(&account_name, &domain_name).expect("UPN");
 
-            assert_eq!(username.account_name(), account_name);
-            assert_eq!(username.domain_name(), Some(domain_name.as_str()));
+            assert_eq!(username.account_name(), format!("{account_name}@{domain_name}"));
+            assert_eq!(username.domain_name(), None);
             assert_eq!(username.format(), UserNameFormat::UserPrincipalName);
 
             check_round_trip_property(&username);

src/lib.rs

@@ -1003,10 +1003,6 @@ where
     ///     .with_credential_use(sspi::CredentialUse::Inbound)
     ///     .with_auth_data(&identity)
     ///     .execute(&mut ntlm).unwrap();
-    ///
-    /// let names = ntlm.query_context_names().unwrap();
-    /// println!("Username: {:?}", names.username.account_name());
-    /// println!("Domain: {:?}", names.username.domain_name());
     /// ```
     ///
     /// # MSDN

tests/sspi/common.rs

@@ -28,9 +28,7 @@ impl<'a> CredentialsProxyImpl<'a> {
 impl credssp::CredentialsProxy for CredentialsProxyImpl<'_> {
     type AuthenticationData = AuthIdentity;
 
-    fn auth_data_by_user(&mut self, username: &Username) -> io::Result<Self::AuthenticationData> {
-        assert_eq!(username.account_name(), self.credentials.username.account_name());
-
+    fn auth_data_by_user(&mut self, _: &Username) -> io::Result<Self::AuthenticationData> {
         Ok(self.credentials.clone())
     }
 }