sssd users from an active directory have the syntax accountname@domain.realm

they can also aliased to domain\accountname and optionally just to "accountname". In any case when you run getent on any of those names you get back the real username "accountname@domain.realm" like here:

# getent passwd bjacke
bjacke@comp.private:*:83542:100:bjacke:/home/comp.private/bjacke:/bin/bash

# getent passwd comp\\bjacke
bjacke@comp.private:*:83542:100:bjacke:/home/comp.private/bjacke:/bin/bash

I see two problems here:

1) even if users log on with the "full qualified name" accountname@domain.realm then it is not possible to limit logons via AllowUsers because the @ is a limiter for the hostname here and I don't see how the @ could be quoted or so.

2) if the user logs on with an alias name then sshd should normalize the name by asking nsswitch like in the above case, to see that bjacke is actually bjacke@comp.private

When I log on as bjacke (who is bjacke@comp.private really) in the sshd log I see:

Postponed keyboard-interactive for invalid user bjacke from 127.0.0.1

even though I set "AllowUsers bjacke". So maybe bjacke is normalized to the real "bjacke@comp.private" name and just the log output is confusing. But even then still the problem remains that there is no way to define a user with @ in AllowUsers...