Just a note regarding this change.
As written in #343, when the user's UPN suffix is different by AD domain:

• UPN suffix = domain.com
• AD domain = domain.local

...using...

var tmpAuthority = upn?.Split('@').Last();

OR

var tmpAuthority = upn?.Contains('@') == true ? upn.Split('@').Last() : string.Empty;

produces the same results: tmpAuthority = domain.com; but then, the LogonUser(...) function will always return 1326 (ERROR_LOGON_FAILURE) even if the end-user has "Must change password at next logon" flag selected - so it should return 1907 (ERROR_PASSWORD_MUST_CHANGE) or its password is expired - so it should return 1330 (ERROR_PASSWORD_EXPIRED).

According to this Microsoft Docs article LogonUserA function:

BOOL LogonUserA(
  LPCSTR  lpszUsername,
  LPCSTR  lpszDomain,
  LPCSTR  lpszPassword,
  DWORD   dwLogonType,
  DWORD   dwLogonProvider,
  PHANDLE phToken
);

lpszUsername

A pointer to a null-terminated string that specifies the name of the user. This is the name of the user account to log on to. If you use the user principal name (UPN) format, User@DNSDomainName, the lpszDomain parameter must be NULL.

If the above is correct, when UPN is used, the domain must be NULL, so the tmpAuthority should be removed and LogonUser(...) like:

if (LogonUser(upn, string.Empty, currentPassword, LogonTypes.Network, LogonProviders.Default, out _))
   return true;

What about ?

You are right, I miss that. I will work on this and let you know when it's finished.

Thank you very much @Serk352.