diff --git a/src/auth/auth-request-var-expand.c b/src/auth/auth-request-var-expand.c
index 964bbf33b6..f1f041e473 100644
--- a/src/auth/auth-request-var-expand.c
+++ b/src/auth/auth-request-var-expand.c
@@ -42,6 +42,9 @@ auth_request_var_expand_static_tab[AUTH_REQUEST_VAR_TAB_COUNT+1] = {
 	{ '\0', NULL, "orig_user" },
 	{ '\0', NULL, "orig_username" },
 	{ '\0', NULL, "orig_domain" },
+	{ '\0', NULL, "auth_user" },
+	{ '\0', NULL, "auth_username" },
+	{ '\0', NULL, "auth_domain" },
 	/* be sure to update AUTH_REQUEST_VAR_TAB_COUNT */
 	{ '\0', NULL, NULL }
 };
@@ -68,7 +71,7 @@ auth_request_get_var_expand_table_full(const struct auth_request *auth_request,
 	const unsigned int auth_count =
 		N_ELEMENTS(auth_request_var_expand_static_tab);
 	struct var_expand_table *tab, *ret_tab;
-	const char *orig_user;
+	const char *orig_user, *auth_user;
 
 	if (escape_func == NULL)
 		escape_func = escape_none;
@@ -154,6 +157,16 @@ auth_request_get_var_expand_table_full(const struct auth_request *auth_request,
 	tab[29].value = strchr(orig_user, '@');
 	if (tab[29].value != NULL)
 		tab[29].value = escape_func(tab[29].value+1, auth_request);
+
+	if (auth_request->master_user != NULL)
+		auth_user = auth_request->master_user;
+	else
+		auth_user = orig_user;
+	tab[30].value = escape_func(auth_user, auth_request);
+	tab[31].value = escape_func(t_strcut(auth_user, '@'), auth_request);
+	tab[32].value = strchr(auth_user, '@');
+	if (tab[32].value != NULL)
+		tab[32].value = escape_func(tab[32].value+1, auth_request);
 	return ret_tab;
 }
 
diff --git a/src/auth/auth-request-var-expand.h b/src/auth/auth-request-var-expand.h
index 180454a469..1362ec3f86 100644
--- a/src/auth/auth-request-var-expand.h
+++ b/src/auth/auth-request-var-expand.h
@@ -8,7 +8,7 @@ auth_request_escape_func_t(const char *string,
 #define AUTH_REQUEST_VAR_TAB_USER_IDX 0
 #define AUTH_REQUEST_VAR_TAB_USERNAME_IDX 1
 #define AUTH_REQUEST_VAR_TAB_DOMAIN_IDX 2
-#define AUTH_REQUEST_VAR_TAB_COUNT 30
+#define AUTH_REQUEST_VAR_TAB_COUNT 33
 extern const struct var_expand_table
 auth_request_var_expand_static_tab[AUTH_REQUEST_VAR_TAB_COUNT+1];