// Launch 20 client threads for each flow
			for flow := 0; flow < 2; flow++ {
				username := usernames[flow]
				flowUser := testUser{name: username}
				rd := RequestDigest{
					RequestInfo: reqInfo,
					User:        flowUser,
				}
				concIntegrator := fq.NewNamedIntegrator(clk, username)
				concIntegrators[flow] = concIntegrator
				exec := func() {
					concIntegrator.Inc()

				{name: "kubeadm-kas", id: 101, gid: 103, shell: noshell},
			},
			groups: []*entry{
				{name: "kubeadm-etcd", id: 102, userNames: []string{"kubeadm-etcd"}},
				{name: "kubeadm-kas", id: 103, userNames: []string{"kubeadm-kas"}},
				{name: "kubeadm-sa-key-readers", id: 104, userNames: []string{"kubeadm-kas", "kubeadm-kcm"}},
			},
			expectedUsers: []*entry{
				{name: "kubeadm-kcm"},
				{name: "kubeadm-ks"},
			},

}

// compressUsername maps all possible usernames onto a small set of categories
// of usernames. This is done both to limit the cardinality of the
// authorized_user_requests metric, and to avoid pushing actual usernames in the
// metric.
func compressUsername(username string) string {
	switch {
	// Known internal identities.
	case username == "admin" ||
		username == "client" ||
		username == "kube_proxy" ||

	}
	groupsToCreateSpec = []*entry{
		{name: constants.EtcdUserName, userNames: []string{constants.EtcdUserName}},
		{name: constants.KubeAPIServerUserName, userNames: []string{constants.KubeAPIServerUserName}},
		{name: constants.KubeControllerManagerUserName, userNames: []string{constants.KubeControllerManagerUserName}},
		{name: constants.KubeSchedulerUserName, userNames: []string{constants.KubeSchedulerUserName}},

		"before trusting usernames in headers specified by --requestheader-username-headers. "+
		"WARNING: generally do not depend on authorization being already done for incoming requests.")

	fs.StringSliceVar(&s.AllowedNames, "requestheader-allowed-names", s.AllowedNames, ""+
		"List of client certificate common names to allow to provide usernames in headers "+

	if u == nil {
		return "", false
	}

	userName := u.GetName()
	if !strings.HasPrefix(userName, nodeUserNamePrefix) {
		return "", false
	}

	isNode := false
	for _, g := range u.GetGroups() {
		if g == user.NodesGroup {
			isNode = true
			break
		}
	}
	if !isNode {
		return "", false
	}

	nodeName := strings.TrimPrefix(userName, nodeUserNamePrefix)
	return nodeName, true

	if len(username) > 0 && strings.EqualFold(username, windowsRootUserName) {
		return fmt.Errorf("container's runAsUser (%s) which will be regarded as root identity and will break non-root policy (pod: %q, container: %s)", username, format.Pod(pod), container.Name)
	}
	return nil

		t.Errorf("didn't get a HomeDir")
	}
	if u.Username == "" {
		t.Errorf("didn't get a username")
	}
}

func BenchmarkCurrent(b *testing.B) {
	for i := 0; i < b.N; i++ {
		Current()
	}
}

func compare(t *testing.T, want, got *User) {
	if want.Uid != got.Uid {
		t.Errorf("got Uid=%q; want %q", got.Uid, want.Uid)
	}
	if want.Username != got.Username {
		t.Errorf("got Username=%q; want %q", got.Username, want.Username)
	}

    # this only splits on the first colon.
    $username, $key = $line -Split ":",2

    # Detect and skip keys without associated usernames, which may come back
    # from the legacy sshKeys metadata.
    if (($username -like "ssh-*") -or ($username -like "ecdsa-*")) {
      Write-Error "Skipping key without username: $username"
      continue
    }
    if (-not $users_to_keys.ContainsKey($username)) {
      $users_to_keys[$username] = @($key)

			"the authentication documentation for further details.")

		fs.StringVar(&o.OIDC.UsernamePrefix, oidcUsernamePrefixFlag, "", ""+
			"If provided, all usernames will be prefixed with this value. If not provided, "+
			"username claims other than 'email' are prefixed by the issuer URL to avoid "+
			"clashes. To skip any prefixing, provide the value '-'.")