test

        for (char &c : nb) c = (char)toupper((unsigned char)c);

        return nb;

    };

    auto upper = [](std::string v) {

        for (char &c : v) c = (char)toupper((unsigned char)c);

        return v;

    };

    /* the client names the domain short (EXAMPLE) or by DNS name, or not at

     * all with a UPN as account (user@example.com). Account and domain go

     * to the DC as sent: the NTLMv2 response is computed over them, and the

     * DC resolves a UPN itself. */

    std::string want = upper(in.domain);

    size_t at = in.account.rfind('@');

    if (want.empty() && at != std::string::npos) want = upper(in.account.substr(at + 1));

    Domain *d = nullptr;

    std::string want = in.domain;

    for (char &c : want) c = (char)toupper((unsigned char)c);

    for (auto &dp : s.domains)

        if (netbios(dp->cfg.domain) == want) { d = dp.get(); break; }

    if (!d) return formatError("no domain " + in.domain);

        if (netbios(dp->cfg.domain) == want || upper(dp->cfg.domain) == want || upper(dp->cfg.krbRealm) == want) {

            d = dp.get();

            break;

        }

    /* no domain at all: our only joined one */

    if (!d && want.empty()) {

        for (auto &dp : s.domains)

            if (dp->cfg.auth == Auth::Kerberos && !dp->cfg.krbPrincipal.empty()) {

                if (d) { d = nullptr; break; }

                d = dp.get();

            }

    }

    if (!d) return formatError("no domain " + (want.empty() ? std::string("given") : want));

    if (d->cfg.auth != Auth::Kerberos || d->cfg.krbPrincipal.empty())

        return formatError(d->cfg.domain + " is not joined");