consider escaped commas in LDAP distinguished name

src/Security/Authentication/Negotiate/src/Internal/LdapAdapter.cs

@@ -6,13 +6,17 @@
 using System.Linq;
 using System.Security.Claims;
 using System.Text;
+using System.Text.RegularExpressions;
 using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;
 
 namespace Microsoft.AspNetCore.Authentication.Negotiate;
 
-internal static class LdapAdapter
+internal static partial class LdapAdapter
 {
+    [GeneratedRegex(@"(?<![^\\]\\),")]
+    internal static partial Regex DistinguishedNameSeparator();
+
     public static async Task RetrieveClaimsAsync(LdapSettings settings, ClaimsIdentity identity, ILogger logger)
     {
         var user = identity.Name!;
@@ -62,7 +66,7 @@ public static async Task RetrieveClaimsAsync(LdapSettings settings, ClaimsIdenti
             {
                 // Example distinguished name: CN=TestGroup,DC=KERB,DC=local
                 var groupDN = $"{Encoding.UTF8.GetString((byte[])group)}";
-                var groupCN = groupDN.Split(',')[0].Substring("CN=".Length);
+                var groupCN = DistinguishedNameSeparator().Split(groupDN)[0].Substring("CN=".Length);
 
                 if (!settings.IgnoreNestedGroups)
                 {
@@ -120,7 +124,7 @@ private static void GetNestedGroups(LdapConnection connection, ClaimsIdentity pr
                 foreach (var member in memberof)
                 {
                     var nestedGroupDN = $"{Encoding.UTF8.GetString((byte[])member)}";
-                    var nestedGroupCN = nestedGroupDN.Split(',')[0].Substring("CN=".Length);
+                    var nestedGroupCN = DistinguishedNameSeparator().Split(nestedGroupDN)[0].Substring("CN=".Length);
 
                     if (processedGroups.Contains(nestedGroupDN))
                     {

src/Security/Authentication/Negotiate/test/Negotiate.Test/LdapAdapterTests.cs

@@ -0,0 +1,39 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Microsoft.AspNetCore.Authentication.Negotiate.Test;
+
+public class LdapAdapterTests
+{
+    [Fact]
+    public void DistinguishedNameWithoutCommasSuccess()
+    {
+        var parts = LdapAdapter.DistinguishedNameSeparator().Split("Testing group - City");
+
+        Assert.Equal(new[] { "Testing group - City" }, parts);
+    }
+
+    [Fact]
+    public void DistinguishedNameWithEscapedCommaSuccess()
+    {
+        var parts = LdapAdapter.DistinguishedNameSeparator().Split(@"Testing group\,City");
+
+        Assert.Equal(new[] { @"Testing group\,City" }, parts);
+    }
+
+    [Fact]
+    public void DistinguishedNameWithNotEscapedCommaSuccess()
+    {
+        var parts = LdapAdapter.DistinguishedNameSeparator().Split("Testing group,City");
+
+        Assert.Equal(new[] { "Testing group", "City" }, parts);
+    }
+
+    [Fact]
+    public void DistinguishedNameWithEscapedBackslashAndNotEscapedCommaSuccess()
+    {
+        var parts = LdapAdapter.DistinguishedNameSeparator().Split(@"Testing group\\,City");
+
+        Assert.Equal(new[] { @"Testing group\\", "City" }, parts);
+    }
+}