UPNIdentityConstraint

using System;
using System.Net.Security;
using System.Security.Principal;

public class Example
{
    public static void Main(string[] args)
    {
        string serverUpn = "service@example.com";
        IIdentity clientIdentity = new GenericIdentity("clientUser", "Kerberos"); // Example client identity

        // Create a UPN identity constraint for the server
        UPNIdentityConstraint constraint = new UPNIdentityConstraint(serverUpn);

        // Simulate receiving an identity and checking against the constraint
        // In a real scenario, this identity would come from NegotiateStream

        // To make this example runnable, we'll create a mock identity that has a UPN
        public class MockUPNIdentity : IIdentity
        {
            public string Name { get; }
            public string AuthenticationType { get; }
            public string UPN { get; }
            public bool IsAuthenticated { get; }

            public MockUPNIdentity(string name, string authType, string upn)
            {
                Name = name;
                AuthenticationType = authType;
                UPN = upn;
                IsAuthenticated = true;
            }
        }

        IIdentity authenticatedIdentity = new MockUPNIdentity("testuser@example.com", "Kerberos", "testuser@example.com");


        if (constraint.IsSatisfiedBy(authenticatedIdentity))
        {
            Console.WriteLine("Identity is satisfied by the UPN constraint.");
        }
        else
        {
            Console.WriteLine("Identity does NOT satisfy the UPN constraint.");
        }

        IIdentity wrongUpnIdentity = new MockUPNIdentity("other@example.net", "Kerberos", "other@example.net");

        if (constraint.IsSatisfiedBy(wrongUpnIdentity))
        {
            Console.WriteLine("Second identity is satisfied by the UPN constraint.");
        }
        else
        {
            Console.WriteLine("Second identity does NOT satisfy the UPN constraint.");
        }
    }
}