`AuthorizedPrincipalsFile` behavior does not match `AuthorizedKeysFile`

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest version
• Search the existing issues.

Steps to reproduce

The sshd_config directive AuthorizedPrincipalsFile fails to read many formats.

1. sign a user key with a principal that is not a valid username on the server
2. create $env:USERPROFILE\.ssh\authorized_principals on the server and add the principal
3. make sure all other forms of authentication are disabled for that user
4. add AuthorizedPrincipalsFile .ssh/authorized_principals to sshd_config (same format as AuthorizedKeysFile .ssh/authorized_keys)
5. observe that logging in fails with error: Certificate does not contain an authorized principal in the sshd log

Expected behavior

`AuthorizedPrincipalsFile` has the same behavior as `AuthorizedKeysFile`

Actual behavior

The following fail:


AuthorizedPrincipalsFile .ssh/authorized_principals
AuthorizedPrincipalsFile .ssh\authorized_principals
AuthorizedPrincipalsFile %h/.ssh/authorized_principals
AuthorizedPrincipalsFile %h\.ssh\authorized_principals
AuthorizedPrincipalsFile C:\Users\%u\.ssh\authorized_principals


This one works:


AuthorizedPrincipalsFile C:/Users/%u/.ssh/authorized_principals

Error details

Environment data

PSVersion                      5.1.26100.7462
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.26100.7462
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Version

OpenSSH_for_Windows_10.0p2 Win32-OpenSSH-GitHub, LibreSSL 4.2.0

Visuals

No response

Start by reproducing the listed AuthorizedPrincipalsFile cases on Windows and compare them with AuthorizedKeysFile using the corresponding sshd_config entries. Trace how each directive resolves relative paths, separators, and %h/%u substitutions. Done means the failing formats behave consistently with AuthorizedKeysFile and the authentication scenario succeeds.