diff --git a/authority/provisioner/provisioner_test.go b/authority/provisioner/provisioner_test.go
index 11615e1a..d79c2b69 100644
--- a/authority/provisioner/provisioner_test.go
+++ b/authority/provisioner/provisioner_test.go
@@ -1,6 +1,8 @@
 package provisioner
 
-import "testing"
+import (
+	"testing"
+)
 
 func TestType_String(t *testing.T) {
 	tests := []struct {
@@ -24,3 +26,29 @@ func TestType_String(t *testing.T) {
 		})
 	}
 }
+
+func TestSanitizeSSHUserPrincipal(t *testing.T) {
+	type args struct {
+		email string
+	}
+	tests := []struct {
+		name string
+		args args
+		want string
+	}{
+		{"simple", args{"foobar"}, "foobar"},
+		{"camelcase", args{"FooBar"}, "foobar"},
+		{"email", args{"foo@example.com"}, "foo"},
+		{"email with dots", args{"foo.bar.zar@example.com"}, "foobarzar"},
+		{"email with dashes", args{"foo-bar-zar@example.com"}, "foo-bar-zar"},
+		{"email with underscores", args{"foo_bar_zar@example.com"}, "foo_bar_zar"},
+		{"email with symbols", args{"Foo.Bar0123456789!#$%&'*+-/=?^_`{|}~;@example.com"}, "foobar0123456789________-___________"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := SanitizeSSHUserPrincipal(tt.args.email); got != tt.want {
+				t.Errorf("SanitizeSSHUserPrincipal() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}