---
title: DomainlessUser (HttpContextExtensions)
summary: Normalize an ambient Windows identity to a bare account name.
status: draft
owner: bendy
last_reviewed: 2026-09-15
library: SAIF.Web.API.Clients
reference_type: package
operation_id: OP-11
trigger: GetJsonResponse step 8; also directly callable by consumers
---

# DomainlessUser (HttpContextExtensions)

`HttpContextExtensions.DomainlessUser` strips a down-level domain prefix (`DOMAIN\`) or a UPN suffix (`@domain`) from the ambient ASP.NET user's identity name, producing the bare account name used in the `OnBehalfOfUser` header.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-11 |
| **Trigger** | [GetJsonResponse](get-json-response.md) step 8; also directly callable by consumers. |
| **Inputs** | Ambient `HttpContext`. |
| **Outputs** | User name without domain qualifier. |
| **Primary components** | `SAIF.Web.API.Clients.Extensions.HttpContextExtensions.DomainlessUser(this HttpContext)` |
| **Entry point** | `src/SAIF.Web.API.Clients/Extensions/HttpContextExtensions.cs` |

## Steps

1. Read `httpContext.User.Identity.Name`.
   - On failure: `NullReferenceException` if `httpContext`, `User`, `Identity`, or `Name` is `null` — no guards exist. For an unauthenticated request, `Name` is `""`.
2. Locate the index of `\` and of `@` ([BR-CLI-004](../business-rules.md#br-cli-004-forwarded-user-name-normalization)).
3. If the `\` index is `> 1`, take the substring after it (down-level logon name `DOMAIN\user` → `user`) ([BR-CLI-004](../business-rules.md#br-cli-004-forwarded-user-name-normalization)).
   - The threshold is `> 1`, not `>= 0`: a name beginning `A\user` (index 1) is not stripped.
4. If the `@` index is `> 1`, take the substring before it (UPN `user@domain` → `user`) ([BR-CLI-004](../business-rules.md#br-cli-004-forwarded-user-name-normalization)).
   - The `@` index is computed on the original string, before the step-3 substring is taken. If both separators are present, the offset is stale and the result can be truncated incorrectly.
5. Return the normalized name ([BR-CLI-004](../business-rules.md#br-cli-004-forwarded-user-name-normalization)).

## Process flow

```mermaid
flowchart TD
	Start([DomainlessUser called]) --> Read["Read<br>httpContext.User.<br>Identity.Name"]
	Read --> Indices["Locate index of<br>backslash and at-sign"]
	Indices --> Backslash{Backslash index &gt; 1?}
	Backslash -->|Yes| StripDomain["Take substring after<br>backslash"]
	Backslash -->|No| AtSign
	StripDomain --> AtSign{At-sign index &gt; 1?}
	AtSign -->|Yes| StripDomainSuffix["Take substring before<br>at-sign"]
	AtSign -->|No| Return([Return normalized name])
	StripDomainSuffix --> Return
```

## Failure and edge-case behavior
- `httpContext`, `User`, `Identity`, or `Name` being `null` throws `NullReferenceException` with no guard.
- A name beginning with a separator at index 0 or 1 (for example `A\user`) is not stripped, because the threshold is `> 1`.
- A name containing both `\` and `@` (for example `DOMAIN\user@domain`) can be truncated incorrectly, because the `@` index is computed on the original string before the `\` substring is taken.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

## Sources
- `src/SAIF.Web.API.Clients/Extensions/HttpContextExtensions.cs`