Retain the "real" username properly like we do for hostnames.

This introduces the concept of a real username. This value comes
from either the initial USER message or from an ident lookup. Doing
this allows us to use it for bans through vidents and cloaking web
client users using their remote username.

While changing this I also changed all of the uses of "ident" other
than RFC 1413 lookups and some compatibility cases to refer to
usernames as user(name) instead of ident. Our use of ident in these
places was incorrect as that only refers to the RFC 1413 response
and is not commonly used in the way we used it by any other IRC
server implementations.

50 files changed, 353 insertions, 255 deletions

diff --git a/src/channels.cpp b/src/channels.cpp
index f3157b488..f302b691f 100644
--- a/src/channels.cpp
+++ b/src/channels.cpp
@@ -290,17 +290,18 @@ bool Channel::CheckBan(User* user, const std::string& mask)
 	if (at == std::string::npos)
 		return false;
 
-	const std::string nickIdent = user->nick + "!" + user->ident;
-	std::string prefix(mask, 0, at);
-	if (InspIRCd::Match(nickIdent, prefix, nullptr))
+	const std::string prefix(mask, 0, at);
+	if (!InspIRCd::Match(user->nick + "!" + user->GetDisplayedUser(), prefix) &&
+		!InspIRCd::Match(user->nick + "!" + user->GetRealUser(), prefix))
 	{
-		std::string suffix(mask, at + 1);
-		if (InspIRCd::Match(user->GetRealHost(), suffix, nullptr) ||
-			InspIRCd::Match(user->GetDisplayedHost(), suffix, nullptr) ||
-			InspIRCd::MatchCIDR(user->GetAddress(), suffix, nullptr))
-			return true;
+		// Neither the nick!user or nick!duser.
+		return false;
 	}
-	return false;
+
+	const std::string suffix(mask, at + 1);
+	return InspIRCd::Match(user->GetRealHost(), suffix) ||
+		InspIRCd::Match(user->GetDisplayedHost(), suffix) ||
+		InspIRCd::MatchCIDR(user->GetAddress(), suffix);
 }
 
 /* Channel::PartUser
diff --git a/src/cidr.cpp b/src/cidr.cpp
index 8169129f7..e7e662365 100644
--- a/src/cidr.cpp
+++ b/src/cidr.cpp
@@ -34,8 +34,8 @@ bool irc::sockets::MatchCIDR(const std::string& address, const std::string& cidr
 	std::string address_copy;
 	std::string cidr_copy;
 
-	/* The caller is trying to match ident@<mask>/bits.
-	 * Chop off the ident@ portion, use match() on it
+	/* The caller is trying to match username@<mask>/bits.
+	 * Chop off the username@ portion, use match() on it
 	 * separately.
 	 */
 	if (match_with_username)
diff --git a/src/configreader.cpp b/src/configreader.cpp
index 12982c435..09c9d070a 100644
--- a/src/configreader.cpp
+++ b/src/configreader.cpp
@@ -45,7 +45,7 @@ ServerLimits::ServerLimits(const std::shared_ptr<ConfigTag>& tag)
 	, MaxNick(tag->getNum<size_t>("maxnick", 30, 1, MaxLine))
 	, MaxChannel(tag->getNum<size_t>("maxchan", 60, 1, MaxLine))
 	, MaxModes(tag->getNum<size_t>("maxmodes", 20, 1))
-	, MaxUser(tag->getNum<size_t>("maxident", 10, 1))
+	, MaxUser(tag->getNum<size_t>("maxuser", tag->getNum<size_t>("maxident", 10, 1, MaxLine), 1, MaxLine))
 	, MaxQuit(tag->getNum<size_t>("maxquit", 300, 0, MaxLine))
 	, MaxTopic(tag->getNum<size_t>("maxtopic", 330, 1, MaxLine))
 	, MaxKick(tag->getNum<size_t>("maxkick", 300, 1, MaxLine))
diff --git a/src/coremods/core_stats.cpp b/src/coremods/core_stats.cpp
index 95601fa55..838c4dc7e 100644
--- a/src/coremods/core_stats.cpp
+++ b/src/coremods/core_stats.cpp
@@ -91,10 +91,10 @@ public:
 
 static void GenerateStatsLl(Stats::Context& stats)
 {
-	stats.AddRow(211, INSP_FORMAT("nick[ident@{}] sendq cmds_out bytes_out cmds_in bytes_in time_open", stats.GetSymbol() == 'l' ? "host" : "ip"));
+	stats.AddRow(211, INSP_FORMAT("nick[user@{}] sendq cmds_out bytes_out cmds_in bytes_in time_open", stats.GetSymbol() == 'l' ? "host" : "ip"));
 
 	for (auto* u : ServerInstance->Users.GetLocalUsers())
-		stats.AddRow(211, u->nick+"["+u->ident+"@"+(stats.GetSymbol() == 'l' ? u->GetDisplayedHost() : u->GetAddress())+"] "+ConvToStr(u->eh.GetSendQSize())+" "+ConvToStr(u->cmds_out)+" "+ConvToStr(u->bytes_out)+" "+ConvToStr(u->cmds_in)+" "+ConvToStr(u->bytes_in)+" "+ConvToStr(ServerInstance->Time() - u->signon));
+		stats.AddRow(211, u->nick+"["+u->GetDisplayedUser()+"@"+(stats.GetSymbol() == 'l' ? u->GetDisplayedHost() : u->GetAddress())+"] "+ConvToStr(u->eh.GetSendQSize())+" "+ConvToStr(u->cmds_out)+" "+ConvToStr(u->bytes_out)+" "+ConvToStr(u->cmds_in)+" "+ConvToStr(u->bytes_in)+" "+ConvToStr(ServerInstance->Time() - u->signon));
 }
 
 void CommandStats::DoStats(Stats::Context& stats)
@@ -358,7 +358,7 @@ void CommandStats::DoStats(Stats::Context& stats)
 
 	stats.AddRow(219, statschar, "End of /STATS report");
 	ServerInstance->SNO.WriteToSnoMask('t', "{} '{}' requested by {} ({}@{})", (IS_LOCAL(user) ? "Stats" : "Remote stats"),
-		statschar, user->nick, user->ident, user->GetRealHost());
+		statschar, user->nick, user->GetRealUser(), user->GetRealHost());
 }
 
 CmdResult CommandStats::Handle(User* user, const Params& parameters)
diff --git a/src/coremods/core_user/cmd_user.cpp b/src/coremods/core_user/cmd_user.cpp
index 4bd318a1b..18ff92d51 100644
--- a/src/coremods/core_user/cmd_user.cpp
+++ b/src/coremods/core_user/cmd_user.cpp
@@ -45,14 +45,14 @@ CmdResult CommandUser::HandleLocal(LocalUser* user, const Params& parameters)
 	/* A user may only send the USER command once */
 	if (!(user->connected & User::CONN_USER))
 	{
-		if (!ServerInstance->IsIdent(parameters[0]))
+		if (!ServerInstance->IsUser(parameters[0]))
 		{
 			user->WriteNumeric(ERR_INVALIDUSERNAME, name, "Your username is not valid");
 			return CmdResult::FAILURE;
 		}
 		else
 		{
-			user->ChangeIdent(parameters[0]);
+			user->ChangeRealUser(parameters[0], true);
 			user->ChangeRealName(parameters[3]);
 			user->connected |= User::CONN_USER;
 		}
diff --git a/src/coremods/core_user/cmd_userhost.cpp b/src/coremods/core_user/cmd_userhost.cpp
index ced65bc21..1a3893958 100644
--- a/src/coremods/core_user/cmd_userhost.cpp
+++ b/src/coremods/core_user/cmd_userhost.cpp
@@ -55,7 +55,7 @@ CmdResult CommandUserhost::Handle(User* user, const Params& parameters)
 
 			retbuf += '=';
 			retbuf += (u->IsAway() ? '-' : '+');
-			retbuf += u->ident;
+			retbuf += u->GetUser(u == user || has_privs);
 			retbuf += '@';
 			retbuf += u->GetHost(u == user || has_privs);
 			retbuf += ' ';
diff --git a/src/coremods/core_who.cpp b/src/coremods/core_who.cpp
index e8220d87d..5235d13eb 100644
--- a/src/coremods/core_who.cpp
+++ b/src/coremods/core_who.cpp
@@ -385,16 +385,19 @@ bool CommandWho::MatchUser(LocalUser* source, User* user, WhoData& data)
 			match = true;
 	}
 
-	// The source wants to match against users' idents.
+	// The source wants to match against users' usernames.
 	else if (data.flags['u'])
-		match = InspIRCd::Match(user->ident, data.matchtext, ascii_case_insensitive_map);
+	{
+		const std::string username = user->GetUser(source_can_see_target && data.flags['x']);
+		match = InspIRCd::Match(username, data.matchtext, ascii_case_insensitive_map);
+	}
 
 	// The <name> passed to WHO is matched against users' host, server,
 	// real name and nickname if the channel <name> cannot be found.
 	else
 	{
-		const std::string host = user->GetHost(source_can_see_target && data.flags['x']);
-		match = InspIRCd::Match(host, data.matchtext, ascii_case_insensitive_map);
+		const std::string hostname = user->GetHost(source_can_see_target && data.flags['x']);
+		match = InspIRCd::Match(hostname, data.matchtext, ascii_case_insensitive_map);
 
 		if (!match)
 		{
@@ -473,9 +476,9 @@ void CommandWho::SendWhoLine(LocalUser* source, const std::vector<std::string>&
 		if (data.whox_fields['c'])
 			wholine.push(memb ? memb->chan->name : "*");
 
-		// Include the user's ident.
+		// Include the user's username.
 		if (data.whox_fields['u'])
-			wholine.push(user->ident);
+			wholine.push(user->GetUser(source_can_see_target && data.flags['x']));
 
 		// Include the user's IP address.
 		if (data.whox_fields['i'])
@@ -560,8 +563,8 @@ void CommandWho::SendWhoLine(LocalUser* source, const std::vector<std::string>&
 		// Include the channel name.
 		wholine.push(memb ? memb->chan->name : "*");
 
-		// Include the user's ident.
-		wholine.push(user->ident);
+		// Include the user's username.
+		wholine.push(user->GetUser(source_can_see_target && data.flags['x']));
 
 		// Include the user's hostname.
 		wholine.push(user->GetHost(source_can_see_target && data.flags['x']));
diff --git a/src/coremods/core_whois.cpp b/src/coremods/core_whois.cpp
index 42cc85873..e9df28f07 100644
--- a/src/coremods/core_whois.cpp
+++ b/src/coremods/core_whois.cpp
@@ -199,7 +199,7 @@ void CommandWhois::DoWhois(LocalUser* user, User* dest, time_t signon, unsigned
 {
 	WhoisContextImpl whois(user, dest, lineevprov);
 
-	whois.SendLine(RPL_WHOISUSER, dest->ident, dest->GetDisplayedHost(), '*', dest->GetRealName());
+	whois.SendLine(RPL_WHOISUSER, dest->GetDisplayedUser(), dest->GetDisplayedHost(), '*', dest->GetRealName());
 	if (!dest->server->IsService() && (whois.IsSelfWhois() || user->HasPrivPermission("users/auspex")))
 	{
 		whois.SendLine(RPL_WHOISACTUALLY, dest->GetRealUserHost(), dest->GetAddress(), "is connecting from");
diff --git a/src/coremods/core_whowas.cpp b/src/coremods/core_whowas.cpp
index bd4f56ee2..b54daaecf 100644
--- a/src/coremods/core_whowas.cpp
+++ b/src/coremods/core_whowas.cpp
@@ -45,14 +45,17 @@ namespace WhoWas
 	/** One entry for a nick. There may be multiple entries for a nick. */
 	struct Entry final
 	{
-		/** Real host */
+		/** Real hostname */
 		const std::string host;
 
-		/** Displayed host */
+		/** Displayed hostname */
 		const std::string dhost;
 
-		/** Ident */
-		const std::string ident;
+		/** Real username */
+		const std::string user;
+
+		/** Displayed username */
+		const std::string duser;
 
 		/** Server name */
 		const std::string server;
@@ -225,10 +228,10 @@ CmdResult CommandWhowas::Handle(User* user, const Params& parameters)
 
 		for (const auto* u : insp::iterator_range(nick->entries.rbegin(), last))
 		{
-			user->WriteNumeric(RPL_WHOWASUSER, parameters[0], u->ident, u->dhost, '*', u->real);
+			user->WriteNumeric(RPL_WHOWASUSER, parameters[0], u->duser, u->dhost, '*', u->real);
 
 			if (user->HasPrivPermission("users/auspex"))
-				user->WriteNumeric(RPL_WHOWASIP, parameters[0], INSP_FORMAT("was connecting from *@{}", u->host));
+				user->WriteNumeric(RPL_WHOWASIP, parameters[0], INSP_FORMAT("was connecting from {}@{}", u->user, u->host));
 
 			const std::string signon = Time::ToString(u->signon);
 			bool hide_server = (!ServerInstance->Config->HideServer.empty() && !user->HasPrivPermission("servers/auspex"));
@@ -392,13 +395,14 @@ void WhoWas::Manager::PurgeNick(WhoWas::Nick* nick)
 	PurgeNick(it);
 }
 
-WhoWas::Entry::Entry(User* user)
-	: host(user->GetRealHost())
-	, dhost(user->GetDisplayedHost())
-	, ident(user->ident)
-	, server(user->server->GetPublicName())
-	, real(user->GetRealName())
-	, signon(user->signon)
+WhoWas::Entry::Entry(User* u)
+	: host(u->GetRealHost())
+	, dhost(u->GetDisplayedHost())
+	, user(u->GetRealUser())
+	, duser(u->GetDisplayedUser())
+	, server(u->server->GetPublicName())
+	, real(u->GetRealName())
+	, signon(u->signon)
 {
 }
 
diff --git a/src/coremods/core_xline/cmd_eline.cpp b/src/coremods/core_xline/cmd_eline.cpp
index ba459a829..f063dd6cf 100644
--- a/src/coremods/core_xline/cmd_eline.cpp
+++ b/src/coremods/core_xline/cmd_eline.cpp
@@ -44,16 +44,16 @@ CmdResult CommandEline::Handle(User* user, const Params& parameters)
 	std::string target = parameters[0];
 	if (parameters.size() >= 3)
 	{
-		IdentHostPair ih;
+		UserHostPair ih;
 		auto* find = ServerInstance->Users.Find(target, true);
 		if (find)
 		{
-			ih.first = find->GetBanIdent();
+			ih.first = find->GetBanUser(true);
 			ih.second = find->GetAddress();
 			target = ih.first + "@" + ih.second;
 		}
 		else
-			ih = XLineManager::IdentSplit(target);
+			ih = XLineManager::SplitUserHost(target);
 
 		if (ih.first.empty())
 		{
diff --git a/src/coremods/core_xline/cmd_gline.cpp b/src/coremods/core_xline/cmd_gline.cpp
index 845e70421..16d646f83 100644
--- a/src/coremods/core_xline/cmd_gline.cpp
+++ b/src/coremods/core_xline/cmd_gline.cpp
@@ -45,16 +45,16 @@ CmdResult CommandGline::Handle(User* user, const Params& parameters)
 	std::string target = parameters[0];
 	if (parameters.size() >= 3)
 	{
-		IdentHostPair ih;
+		UserHostPair ih;
 		auto* find = ServerInstance->Users.Find(target, true);
 		if (find)
 		{
-			ih.first = find->GetBanIdent();
+			ih.first = find->GetBanUser(true);
 			ih.second = find->GetAddress();
 			target = ih.first + "@" + ih.second;
 		}
 		else
-			ih = XLineManager::IdentSplit(target);
+			ih = XLineManager::SplitUserHost(target);
 
 		if (ih.first.empty())
 		{
diff --git a/src/coremods/core_xline/cmd_kline.cpp b/src/coremods/core_xline/cmd_kline.cpp
index 3e05bfd1b..16fbad1d8 100644
--- a/src/coremods/core_xline/cmd_kline.cpp
+++ b/src/coremods/core_xline/cmd_kline.cpp
@@ -45,16 +45,16 @@ CmdResult CommandKline::Handle(User* user, const Params& parameters)
 	std::string target = parameters[0];
 	if (parameters.size() >= 3)
 	{
-		IdentHostPair ih;
+		UserHostPair ih;
 		auto* find = ServerInstance->Users.Find(target, true);
 		if (find)
 		{
-			ih.first = find->GetBanIdent();
+			ih.first = find->GetBanUser(true);
 			ih.second = find->GetAddress();
 			target = ih.first + "@" + ih.second;
 		}
 		else
-			ih = XLineManager::IdentSplit(target);
+			ih = XLineManager::SplitUserHost(target);
 
 		if (ih.first.empty())
 		{
diff --git a/src/coremods/core_xline/core_xline.cpp b/src/coremods/core_xline/core_xline.cpp
index eccf0c0fe..c0c41cff8 100644
--- a/src/coremods/core_xline/core_xline.cpp
+++ b/src/coremods/core_xline/core_xline.cpp
@@ -141,6 +141,16 @@ public:
 		luser->CheckLines(false);
 	}
 
+	void OnPostChangeRealUser(User* user) override
+	{
+		LocalUser* luser = IS_LOCAL(user);
+		if (!luser || luser->quitting)
+			return;
+
+		luser->exempt = !!ServerInstance->XLines->MatchesLine("E", user);
+		luser->CheckLines(false);
+	}
+
 	ModResult OnUserPreNick(LocalUser* user, const std::string& newnick) override
 	{
 		// Check Q-lines (for local nick changes only, remote servers have our Q-lines to enforce themselves)
diff --git a/src/helperfuncs.cpp b/src/helperfuncs.cpp
index 162bbfe07..203c5de04 100644
--- a/src/helperfuncs.cpp
+++ b/src/helperfuncs.cpp
@@ -205,8 +205,8 @@ bool InspIRCd::DefaultIsNick(const std::string_view& n)
 	return true;
 }
 
-/* return true for good ident, false else */
-bool InspIRCd::DefaultIsIdent(const std::string_view& n)
+/* return true for good username, false else */
+bool InspIRCd::DefaultIsUser(const std::string_view& n)
 {
 	if (n.empty())
 		return false;
diff --git a/src/modules.cpp b/src/modules.cpp
index 603210ce6..4d45bd016 100644
--- a/src/modules.cpp
+++ b/src/modules.cpp
@@ -143,7 +143,9 @@ void		Module::OnChangeHost(User*, const std::string&) { DetachEvent(I_OnChangeHo
 void		Module::OnChangeRealHost(User*, const std::string&) { DetachEvent(I_OnChangeRealHost); }
 void		Module::OnPostChangeRealHost(User*) { DetachEvent(I_OnPostChangeRealHost); }
 void		Module::OnChangeRealName(User*, const std::string&) { DetachEvent(I_OnChangeRealName); }
-void		Module::OnChangeIdent(User*, const std::string&) { DetachEvent(I_OnChangeIdent); }
+void		Module::OnChangeUser(User*, const std::string&) { DetachEvent(I_OnChangeUser); }
+void		Module::OnChangeRealUser(User*, const std::string&) { DetachEvent(I_OnChangeRealUser); }
+void		Module::OnPostChangeRealUser(User*) { DetachEvent(I_OnPostChangeRealUser); }
 void		Module::OnAddLine(User*, XLine*) { DetachEvent(I_OnAddLine); }
 void		Module::OnDelLine(User*, XLine*) { DetachEvent(I_OnDelLine); }
 void		Module::OnExpireLine(XLine*) { DetachEvent(I_OnExpireLine); }
diff --git a/src/modules/m_alias.cpp b/src/modules/m_alias.cpp
index 32b1ac72b..83bcabb86 100644
--- a/src/modules/m_alias.cpp
+++ b/src/modules/m_alias.cpp
@@ -351,10 +351,10 @@ public:
 						result.append(chan->name);
 					i += 4;
 				}
-				else if (!newline.compare(i, 6, "$ident", 6))
+				else if (!newline.compare(i, 5, "$user", 5))
 				{
-					result.append(user->ident);
-					i += 5;
+					result.append(user->GetRealUser());
+					i += 4;
 				}
 				else if (!newline.compare(i, 6, "$vhost", 6))
 				{
@@ -366,6 +366,13 @@ public:
 					result.append(a.RequiredNick);
 					i += 11;
 				}
+				else if (!newline.compare(i, 6, "$ident", 6))
+				{
+					// TODO: remove this in the next major release.
+					result.append(user->GetRealHost());
+					i += 5;
+				}
+
 				else
 					result.push_back(c);
 			}
diff --git a/src/modules/m_anticaps.cpp b/src/modules/m_anticaps.cpp
index fad0421fc..7bf6699bc 100644
--- a/src/modules/m_anticaps.cpp
+++ b/src/modules/m_anticaps.cpp
@@ -169,7 +169,7 @@ private:
 	void CreateBan(Channel* channel, User* user, bool mute)
 	{
 		std::string banmask(mute ? "m:*!" : "*!");
-		banmask.append(user->GetBanIdent());
+		banmask.append(user->GetBanUser(false));
 		banmask.append("@");
 		banmask.append(user->GetDisplayedHost());
 
diff --git a/src/modules/m_banredirect.cpp b/src/modules/m_banredirect.cpp
index 6cb06f5d9..33db4b1ff 100644
--- a/src/modules/m_banredirect.cpp
+++ b/src/modules/m_banredirect.cpp
@@ -69,10 +69,10 @@ public:
 
 	bool BeforeMode(User* source, User* dest, Channel* channel, Modes::Change& change) override
 	{
-		/* nick!ident@host -> nick!ident@host
-		 * nick!ident@host#chan -> nick!ident@host#chan
+		/* nick!user@host -> nick!user@host
+		 * nick!user@host#chan -> nick!user@host#chan
 		 * nick@host#chan -> nick!*@host#chan
-		 * nick!ident#chan -> nick!ident@*#chan
+		 * nick!user#chan -> nick!user@*#chan
 		 * nick#chan -> nick!*@*#chan
 		 */
 
@@ -81,7 +81,7 @@ public:
 			BanRedirectList* redirects;
 
 			std::string mask[4];
-			enum { NICK, IDENT, HOST, CHAN } current = NICK;
+			enum { NICK, USER, HOST, CHAN } current = NICK;
 			std::string::iterator start_pos = change.param.begin();
 
 			std::string unused = change.param;
@@ -109,11 +109,11 @@ public:
 						if (current != NICK)
 							break;
 						mask[current].assign(start_pos, curr);
-						current = IDENT;
+						current = USER;
 						start_pos = curr+1;
 						break;
 					case '@':
-						if (current != IDENT)
+						if (current != USER)
 							break;
 						mask[current].assign(start_pos, curr);
 						current = HOST;
@@ -135,13 +135,13 @@ public:
 			}
 
 			/* nick@host wants to be changed to *!nick@host rather than nick!*@host... */
-			if(mask[NICK].length() && mask[HOST].length() && mask[IDENT].empty())
+			if(mask[NICK].length() && mask[HOST].length() && mask[USER].empty())
 			{
 				/* std::string::swap() is fast - it runs in constant time */
-				mask[NICK].swap(mask[IDENT]);
+				mask[NICK].swap(mask[USER]);
 			}
 
-			if (!mask[NICK].empty() && mask[IDENT].empty() && mask[HOST].empty())
+			if (!mask[NICK].empty() && mask[USER].empty() && mask[HOST].empty())
 			{
 				if (mask[NICK].find('.') != std::string::npos || mask[NICK].find(':') != std::string::npos)
 				{
@@ -157,7 +157,7 @@ public:
 				}
 			}
 
-			change.param.assign(mask[NICK]).append(1, '!').append(mask[IDENT]).append(1, '@').append(mask[HOST]);
+			change.param.assign(mask[NICK]).append(1, '!').append(mask[USER]).append(1, '@').append(mask[HOST]);
 
 			if(mask[CHAN].length())
 			{
diff --git a/src/modules/m_check.cpp b/src/modules/m_check.cpp
index 552199720..cd2a80cd8 100644
--- a/src/modules/m_check.cpp
+++ b/src/modules/m_check.cpp
@@ -141,7 +141,7 @@ public:
 		access_needed = CmdAccess::OPERATOR;
 		syntax = {
 			"<nick>|<channel> [<servername>]",
-			"<nickmask>|<identmask>|<hostmask>|<ipmask>|<realnamemask> [<servername>]",
+			"<nickmask>|<usermask>|<hostmask>|<ipmask>|<realnamemask> [<servername>]",
 		};
 	}
 
@@ -267,8 +267,11 @@ public:
 				if (InspIRCd::Match(u->nick, parameters[0], ascii_case_insensitive_map))
 					matches.push_back("nick");
 
-				if (InspIRCd::Match(u->ident, parameters[0], ascii_case_insensitive_map))
-					matches.push_back("ident");
+				if (InspIRCd::Match(u->GetRealUser(), parameters[0], ascii_case_insensitive_map))
+					matches.push_back("ruser");
+
+				if (InspIRCd::Match(u->GetDisplayedUser(), parameters[0], ascii_case_insensitive_map))
+					matches.push_back("duser");
 
 				if (InspIRCd::Match(u->GetRealHost(), parameters[0], ascii_case_insensitive_map))
 					matches.push_back("rhost");
@@ -285,8 +288,8 @@ public:
 				if (!matches.empty())
 				{
 					const std::string whatmatch = stdalgo::string::join(matches, ',');
-					context.Write("match", INSP_FORMAT("{} {} {} {} {} {} {} :{}", ++x, whatmatch, u->nick, u->ident,
-						u->GetRealHost(), u->GetDisplayedHost(), u->GetAddress(), u->GetRealName()));
+					context.Write("match", INSP_FORMAT("{} {} {} {} {} {} {} {} :{}", ++x, whatmatch, u->nick, u->GetRealUser(),
+						u->GetDisplayedUser(), u->GetRealHost(), u->GetDisplayedHost(), u->GetAddress(), u->GetRealName()));
 					matches.clear();
 				}
 			}
diff --git a/src/modules/m_chgident.cpp b/src/modules/m_chgident.cpp
index 52d409027..ccbd5d762 100644
--- a/src/modules/m_chgident.cpp
+++ b/src/modules/m_chgident.cpp
@@ -36,7 +36,7 @@ public:
 		: Command(Creator, "CHGIDENT", 2)
 	{
 		access_needed = CmdAccess::OPERATOR;
-		syntax = { "<nick> <ident>" };
+		syntax = { "<nick> <username>" };
 		translation = { TR_NICK, TR_TEXT };
 	}
 
@@ -51,22 +51,25 @@ public:
 
 		if (parameters[1].length() > ServerInstance->Config->Limits.MaxUser)
 		{
-			user->WriteNotice("*** CHGIDENT: Ident is too long");
+			user->WriteNotice("*** CHGIDENT: Username is too long");
 			return CmdResult::FAILURE;
 		}
 
-		if (!ServerInstance->IsIdent(parameters[1]))
+		if (!ServerInstance->IsUser(parameters[1]))
 		{
-			user->WriteNotice("*** CHGIDENT: Invalid characters in ident");
+			user->WriteNotice("*** CHGIDENT: Invalid characters in username");
 			return CmdResult::FAILURE;
 		}
 
 		if (IS_LOCAL(dest))
 		{
-			dest->ChangeIdent(parameters[1]);
+			dest->ChangeDisplayedUser(parameters[1]);
 
 			if (!user->server->IsService())
-				ServerInstance->SNO.WriteGlobalSno('a', "{} used CHGIDENT to change {}'s ident to '{}'", user->nick, dest->nick, dest->ident);
+			{
+				ServerInstance->SNO.WriteGlobalSno('a', "{} used CHGIDENT to change {}'s username to '{}'",
+					user->nick, dest->nick, dest->GetDisplayedUser());
+			}
 		}
 
 		return CmdResult::SUCCESS;
@@ -86,7 +89,7 @@ private:
 
 public:
 	ModuleChgIdent()
-		: Module(VF_VENDOR | VF_OPTCOMMON, "Adds the /CHGIDENT command which allows server operators to change the username (ident) of a user.")
+		: Module(VF_VENDOR | VF_OPTCOMMON, "Adds the /CHGIDENT command which allows server operators to change the username of a user.")
 		, cmd(this)
 	{
 	}
diff --git a/src/modules/m_clearchan.cpp b/src/modules/m_clearchan.cpp
index 170faeccf..f8c8a567c 100644
--- a/src/modules/m_clearchan.cpp
+++ b/src/modules/m_clearchan.cpp
@@ -119,7 +119,7 @@ public:
 				XLine* xline;
 				try
 				{
-					mask = (method[0] == 'Z') ? curr->GetAddress() : (curr->GetBanIdent() + "@" + curr->GetRealHost());
+					mask = (method[0] == 'Z') ? curr->GetAddress() : (curr->GetBanUser(true) + "@" + curr->GetRealHost());
 					xline = xlf->Generate(ServerInstance->Time(), 60*60, user->nick, reason, mask);
 				}
 				catch (const ModuleException&)
diff --git a/src/modules/m_cloak.cpp b/src/modules/m_cloak.cpp
index 61bcdf0f6..c9e313636 100644
--- a/src/modules/m_cloak.cpp
+++ b/src/modules/m_cloak.cpp
@@ -409,7 +409,11 @@ public:
 			if (cloak == user->GetDisplayedHost())
 				continue; // This is checked by the core.
 
-			const std::string cloakmask = user->nick + "!" + user->ident + "@" + cloak;
+			std::string cloakmask = user->nick + "!" + user->GetRealUser() + "@" + cloak;
+			if (InspIRCd::Match(cloakmask, mask))
+				return MOD_RES_DENY;
+
+			cloakmask = user->nick + "!" + user->GetDisplayedUser() + "@" + cloak;
 			if (InspIRCd::Match(cloakmask, mask))
 				return MOD_RES_DENY;
 		}
diff --git a/src/modules/m_cloak_user.cpp b/src/modules/m_cloak_user.cpp
index a845705fe..d76b74a62 100644
--- a/src/modules/m_cloak_user.cpp
+++ b/src/modules/m_cloak_user.cpp
@@ -210,7 +210,7 @@ private:
 	// Retrieves the middle segment of the cloak.
 	std::string GetMiddle(LocalUser* user) override
 	{
-		return user->ident;
+		return user->GetRealUser();
 	}
 
 public:
@@ -289,7 +289,7 @@ public:
 			cloakapi->ResetCloaks(luser, true);
 	}
 
-	void OnChangeIdent(User* user, const std::string& ident) override
+	void OnChangeRealUser(User* user, const std::string& newuser) override
 	{
 		LocalUser* luser = IS_LOCAL(user);
 		if (luser && cloakapi && cloakapi->IsActiveCloak(usernamecloak))
diff --git a/src/modules/m_dccallow.cpp b/src/modules/m_dccallow.cpp
index 73a050b2a..7607f54a4 100644
--- a/src/modules/m_dccallow.cpp
+++ b/src/modules/m_dccallow.cpp
@@ -296,7 +296,7 @@ public:
 						}
 					}
 
-					std::string mask = target->nick+"!"+target->ident+"@"+target->GetDisplayedHost();
+					std::string mask = target->GetMask();
 					unsigned long length;
 					if (parameters.size() < 2)
 					{
@@ -506,14 +506,14 @@ public:
 							return MOD_RES_PASSTHRU;
 
 						user->WriteNotice("The user " + u->nick + " is not accepting DCC SENDs from you. Your file " + filename + " was not sent.");
-						u->WriteNotice(user->nick + " (" + user->ident + "@" + user->GetDisplayedHost() + ") attempted to send you a file named " + filename + ", which was blocked.");
+						u->WriteNotice(user->nick + " (" + user->GetUserHost() + ") attempted to send you a file named " + filename + ", which was blocked.");
 						u->WriteNotice("If you trust " + user->nick + " and were expecting this, you can type /DCCALLOW HELP for information on the DCCALLOW system.");
 						return MOD_RES_DENY;
 					}
 					else if (blockchat && irc::equals(type, "CHAT"))
 					{
 						user->WriteNotice("The user " + u->nick + " is not accepting DCC CHAT requests from you.");
-						u->WriteNotice(user->nick + " (" + user->ident + "@" + user->GetDisplayedHost() + ") attempted to initiate a DCC CHAT session, which was blocked.");
+						u->WriteNotice(user->nick + " (" + user->GetUserHost() + ") attempted to initiate a DCC CHAT session, which was blocked.");
 						u->WriteNotice("If you trust " + user->nick + " and were expecting this, you can type /DCCALLOW HELP for information on the DCCALLOW system.");
 						return MOD_RES_DENY;
 					}
diff --git a/src/modules/m_dnsbl.cpp b/src/modules/m_dnsbl.cpp
index ca6aa6468..43c5fda8c 100644
--- a/src/modules/m_dnsbl.cpp
+++ b/src/modules/m_dnsbl.cpp
@@ -81,8 +81,8 @@ public:
 	// If action is set to mark then a new hostname to set on users who's IP address is in this DNSBL.
 	std::string markhost;
 
-	// If action is set to mark then a new username (ident) to set on users who's IP address is in this DNSBL.
-	std::string markident;
+	// If action is set to mark then a new username to set on users who's IP address is in this DNSBL.
+	std::string markuser;
 
 	// The human readable name of this DNSBL.
 	std::string name;
@@ -158,17 +158,17 @@ public:
 
 		reason = tag->getString("reason", "Your IP (%ip%) has been blacklisted by the %dnsbl% DNSBL.", 1, ServerInstance->Config->Limits.MaxLine);
 		timeout = static_cast<unsigned int>(tag->getDuration("timeout", 0, 1, 60));
-		markident = tag->getString("ident");
+		markuser = tag->getString("user", tag->getString("ident"));
 		markhost = tag->getString("host");
 		xlineduration = tag->getDuration("duration", 60*60, 1);
 	}
 };
 
-class DNSBLIdentHost final
+class DNSBLMask final
 {
 public:
-	// The ident to give a user because they were in a DNSBL (<dnsbl:ident>).
-	std::string ident;
+	// The username to give a user because they were in a DNSBL (<dnsbl:user>).
+	std::string user;
 
 	// The hostname to give a user because they were in a DNSBL (<dnsbl:host>).
 	std::string host;
@@ -176,15 +176,15 @@ public:
 	// The reason why the user was given this user@host (<dnsbl:reason>).
 	std::string reason;
 
-	DNSBLIdentHost(const std::shared_ptr<DNSBLEntry>& cfg, const std::string& msg)
-		: ident(cfg->markident)
+	DNSBLMask(const std::shared_ptr<DNSBLEntry>& cfg, const std::string& msg)
+		: user(cfg->markuser)
 		, host(cfg->markhost)
 		, reason(msg)
 	{
 	}
 };
 
-typedef SimpleExtItem<DNSBLIdentHost> IdentHostExtItem;
+typedef SimpleExtItem<DNSBLMask> MaskExtItem;
 typedef ListExtItem<std::vector<std::string>> MarkExtItem;
 
 // Data which is shared with DNS lookup classes.
@@ -200,8 +200,8 @@ public:
 	// The DNSBL marks which are set on a user.
 	MarkExtItem markext;
 
-	// The ident@host to set on a marked user when they are connected.
-	IdentHostExtItem maskext;
+	// The user@host to set on a marked user when they are connected.
+	MaskExtItem maskext;
 
 	SharedData(Module* mod)
 		: dns(mod)
@@ -329,9 +329,9 @@ public:
 				}
 				case DNSBLEntry::Action::MARK:
 				{
-					if (!config->markident.empty() || !config->markhost.empty())
+					if (!config->markuser.empty() || !config->markhost.empty())
 					{
-						// Store the u@h mask for later to avoid being overwritten by ident/hostname lookups.
+						// Store the u@h mask for later to avoid being overwritten by username/hostname lookups.
 						data.maskext.SetFwd(them, config, reason);
 
 						// If the user is already connected we should just do this now.
@@ -344,12 +344,12 @@ public:
 				}
 				case DNSBLEntry::Action::KLINE:
 				{
-					AddLine<KLine>("K-line", reason, config->xlineduration, them->GetBanIdent(), them->GetAddress());
+					AddLine<KLine>("K-line", reason, config->xlineduration, them->GetBanUser(true), them->GetAddress());
 					break;
 				}
 				case DNSBLEntry::Action::GLINE:
 				{
-					AddLine<GLine>("G-line", reason, config->xlineduration, them->GetBanIdent(), them->GetAddress());
+					AddLine<GLine>("G-line", reason, config->xlineduration, them->GetBanUser(true), them->GetAddress());
 					break;
 				}
 				case DNSBLEntry::Action::ZLINE:
@@ -536,18 +536,18 @@ public:
 
 	void OnUserConnect(LocalUser* user) override
 	{
-		DNSBLIdentHost* ih = data.maskext.Get(user);
+		DNSBLMask* ih = data.maskext.Get(user);
 		if (ih)
 		{
-			if (!ih->ident.empty())
+			if (!ih->user.empty())
 			{
-				user->WriteNotice("Your ident has been set to " + ih->ident + " because you matched " + ih->reason);
-				user->ChangeIdent(ih->ident);
+				user->WriteNotice("Your username has been set to " + ih->user + " because you matched " + ih->reason);
+				user->ChangeDisplayedUser(ih->user);
 			}
 
 			if (!ih->host.empty())
 			{
-				user->WriteNotice("Your host has been set to " + ih->host + " because you matched " + ih->reason);
+				user->WriteNotice("Your hostname has been set to " + ih->host + " because you matched " + ih->reason);
 				user->ChangeDisplayedHost(ih->host);
 			}
 
diff --git a/src/modules/m_gateway.cpp b/src/modules/m_gateway.cpp
index 370c06337..73fd91f8a 100644
--- a/src/modules/m_gateway.cpp
+++ b/src/modules/m_gateway.cpp
@@ -38,23 +38,23 @@
 // One or more hostmask globs or CIDR ranges.
 typedef std::vector<std::string> MaskList;
 
-// Encapsulates information about an ident host.
-class IdentHost final
+// Encapsulates information about an username gateway.
+class UserHost final
 {
 private:
 	MaskList hostmasks;
-	std::string newident;
+	std::string newuser;
 
 public:
-	IdentHost(const MaskList& masks, const std::string& ident)
+	UserHost(const MaskList& masks, const std::string& user)
 		: hostmasks(masks)
-		, newident(ident)
+		, newuser(user)
 	{
 	}
 
-	const std::string& GetIdent() const
+	const std::string& GetUser() const
 	{
-		return newident;
+		return newuser;
 	}
 
 	bool Matches(LocalUser* user) const
@@ -75,7 +75,7 @@ public:
 	}
 };
 
-// Encapsulates information about a WebIRC host.
+// Encapsulates information about a WebIRC gateway.
 class WebIRCHost final
 {
 private:
@@ -169,32 +169,32 @@ public:
 
 	static bool ParseIP(const std::string& in, irc::sockets::sockaddrs& out)
 	{
-		const char* ident = nullptr;
+		const char* user = nullptr;
 		if (in.length() == 8)
 		{
-			// The ident is an IPv4 address encoded in hexadecimal with two characters
+			// The user is an IPv4 address encoded in hexadecimal with two characters
 			// per address segment.
-			ident = in.c_str();
+			user = in.c_str();
 		}
 		else if (in.length() == 9 && in[0] == '~')
 		{
-			// The same as above but m_ident got to this user before we did. Strip the
-			// ident prefix and continue as normal.
-			ident = in.c_str() + 1;
+			// The same as above but m_user got to this user before we did. Strip the
+			// user prefix and continue as normal.
+			user = in.c_str() + 1;
 		}
 		else
 		{
-			// The user either does not have an IPv4 in their ident or the gateway server
-			// is also running an identd. In the latter case there isn't really a lot we
+			// The user either does not have an IPv4 in their user or the gateway server
+			// is also running an userd. In the latter case there isn't really a lot we
 			// can do so we just assume that the client in question is not connecting via
-			// an ident gateway.
+			// an user gateway.
 			return false;
 		}
 
 		// Try to convert the IP address to a string. If this fails then the user
-		// does not have an IPv4 address in their ident.
+		// does not have an IPv4 address in their user.
 		errno = 0;
-		unsigned long address = strtoul(ident, nullptr, 16);
+		unsigned long address = strtoul(user, nullptr, 16);
 		if (errno)
 			return false;
 
@@ -334,7 +334,7 @@ class ModuleGateway final
 private:
 	CommandHexIP cmdhexip;
 	CommandWebIRC cmdwebirc;
-	std::vector<IdentHost> hosts;
+	std::vector<UserHost> hosts;
 
 public:
 	ModuleGateway()
@@ -353,7 +353,7 @@ public:
 
 	void ReadConfig(ConfigStatus& status) override
 	{
-		std::vector<IdentHost> identhosts;
+		std::vector<UserHost> userhosts;
 		std::vector<WebIRCHost> webirchosts;
 
 		for (const auto& [_, tag] : ServerInstance->Config->ConfTags("gateway", ServerInstance->Config->ConfTags("cgihost")))
@@ -369,11 +369,11 @@ public:
 
 			// Determine what lookup type this host uses.
 			const std::string type = tag->getString("type");
-			if (stdalgo::string::equalsci(type, "ident"))
+			if (stdalgo::string::equalsci(type, "username") || stdalgo::string::equalsci(type, "ident"))
 			{
 				// The IP address should be looked up from the hex IP address.
-				const std::string newident = tag->getString("newident", "gateway", ServerInstance->IsIdent);
-				identhosts.emplace_back(masks, newident);
+				const std::string newuser = tag->getString("newusername", tag->getString("newident", "gateway", ServerInstance->IsUser), ServerInstance->IsUser);
+				userhosts.emplace_back(masks, newuser);
 			}
 			else if (stdalgo::string::equalsci(type, "webirc"))
 			{
@@ -402,7 +402,7 @@ public:
 		}
 
 		// The host configuration was valid so we can apply it.
-		hosts.swap(identhosts);
+		hosts.swap(userhosts);
 		cmdwebirc.hosts.swap(webirchosts);
 	}
 
@@ -448,20 +448,20 @@ public:
 				continue;
 
 			// We have matched an gateway block! Try to parse the encoded IPv4 address
-			// out of the ident.
+			// out of the user.
 			irc::sockets::sockaddrs address(user->client_sa);
-			if (!CommandHexIP::ParseIP(user->ident, address))
+			if (!CommandHexIP::ParseIP(user->GetRealUser(), address))
 				return MOD_RES_PASSTHRU;
 
 			// Store the hostname and IP of the gateway for later use.
 			cmdwebirc.realhost.Set(user, user->GetRealHost());
 			cmdwebirc.realip.Set(user, user->GetAddress());
 
-			const std::string& newident = host.GetIdent();
-			ServerInstance->SNO.WriteGlobalSno('w', "Connecting user {} is using an ident gateway; changing their IP from {} to {} and their ident from {} to {}.",
-				user->uuid, user->GetAddress(), address.addr(), user->ident, newident);
+			const std::string& newuser = host.GetUser();
+			ServerInstance->SNO.WriteGlobalSno('w', "Connecting user {} is using an user gateway; changing their IP from {} to {} and their real username from {} to {}.",
+				user->uuid, user->GetAddress(), address.addr(), user->GetRealUser(), newuser);
 
-			user->ChangeIdent(newident);
+			user->ChangeRealUser(newuser, user->GetDisplayedUser() == user->GetRealUser());
 			user->ChangeRemoteAddress(address);
 			break;
 		}
@@ -545,7 +545,7 @@ public:
 		if (gateway)
 			whois.SendLine(RPL_WHOISGATEWAY, *realhost, *realip, "is connected via the " + *gateway + " WebIRC gateway");
 		else
-			whois.SendLine(RPL_WHOISGATEWAY, *realhost, *realip, "is connected via an ident gateway");
+			whois.SendLine(RPL_WHOISGATEWAY, *realhost, *realip, "is connected via an user gateway");
 	}
 };
 
diff --git a/src/modules/m_hostcycle.cpp b/src/modules/m_hostcycle.cpp
index 4ce91034a..7e13ab283 100644
--- a/src/modules/m_hostcycle.cpp
+++ b/src/modules/m_hostcycle.cpp
@@ -27,13 +27,12 @@ class ModuleHostCycle final
 {
 	Cap::Reference chghostcap;
 	const std::string quitmsghost;
-	const std::string quitmsgident;
+	const std::string quitmsguser;
 
-	/** Send fake quit/join/mode messages for host or ident cycle.
-	 */
-	void DoHostCycle(User* user, const std::string& newident, const std::string& newhost, const std::string& reason)
+	// Sends a fake quit/join/mode messages for hostame or username cycle.
+	void DoHostCycle(User* user, const std::string& newuser, const std::string& newhost, const std::string& reason)
 	{
-		// The user has the original ident/host at the time this function is called
+		// The user has the original username/hostname at the time this function is called
 		ClientProtocol::Messages::Quit quitmsg(user, reason);
 		ClientProtocol::Event quitevent(ServerInstance->GetRFCEvents().quit, quitmsg);
 
@@ -64,7 +63,7 @@ class ModuleHostCycle final
 			}
 		}
 
-		std::string newfullhost = user->nick + "!" + newident + "@" + newhost;
+		const std::string newfullhost = user->nick + "!" + newuser + "@" + newhost;
 
 		for (auto* memb : include_chans)
 		{
@@ -94,21 +93,21 @@ class ModuleHostCycle final
 
 public:
 	ModuleHostCycle()
-		: Module(VF_VENDOR, "Sends a fake disconnection and reconnection when a user's username (ident) or hostname changes to allow clients to update their internal caches.")
+		: Module(VF_VENDOR, "Sends a fake disconnection and reconnection when a user's username or hostname changes to allow clients to update their internal caches.")
 		, chghostcap(this, "chghost")
-		, quitmsghost("Changing host")
-		, quitmsgident("Changing ident")
+		, quitmsghost("Changing hostname")
+		, quitmsguser("Changing username")
 	{
 	}
 
-	void OnChangeIdent(User* user, const std::string& newident) override
+	void OnChangeUser(User* user, const std::string& newuser) override
 	{
-		DoHostCycle(user, newident, user->GetDisplayedHost(), quitmsgident);
+		DoHostCycle(user, newuser, user->GetDisplayedHost(), quitmsguser);
 	}
 
 	void OnChangeHost(User* user, const std::string& newhost) override
 	{
-		DoHostCycle(user, user->ident, newhost, quitmsghost);
+		DoHostCycle(user, user->GetDisplayedUser(), newhost, quitmsghost);
 	}
 };
 
diff --git a/src/modules/m_httpd_stats.cpp b/src/modules/m_httpd_stats.cpp
index d160386ab..0ca0f5987 100644
--- a/src/modules/m_httpd_stats.cpp
+++ b/src/modules/m_httpd_stats.cpp
@@ -264,7 +264,8 @@ namespace Stats
 			.Attribute("signon", u->signon)
 			.Attribute("nickchanged", u->nickchanged)
 			.Attribute("modes", u->GetModeLetters().substr(1))
-			.Attribute("ident", u->ident)
+			.Attribute("realuser", u->GetRealUser())
+			.Attribute("displayuser", u->GetDisplayedUser())
 			.Attribute("ipaddress", u->GetAddress());
 
 		if (u->IsAway())
diff --git a/src/modules/m_ident.cpp b/src/modules/m_ident.cpp
index 4e324d87c..0cadd3644 100644
--- a/src/modules/m_ident.cpp
+++ b/src/modules/m_ident.cpp
@@ -246,11 +246,11 @@ public:
 				continue;
 
 			/* Add the next char to the result and see if it's still a valid ident,
-			 * according to IsIdent(). If it isn't, then erase what we just added and
+			 * according to IsUser(). If it isn't, then erase what we just added and
 			 * we're done.
 			 */
 			result += chr;
-			if (!ServerInstance->IsIdent(result))
+			if (!ServerInstance->IsUser(result))
 			{
 				result.pop_back();
 				break;
@@ -280,27 +280,27 @@ private:
 	SimpleExtItem<IdentRequestSocket, Cullable::Deleter> socket;
 	IntExtItem state;
 
-	static void PrefixIdent(LocalUser* user)
+	static void PrefixUser(LocalUser* user)
 	{
 		// Check that they haven't been prefixed already.
-		if (user->ident[0] == '~')
+		if (user->GetRealUser().front() == '~')
 			return;
 
 		// All invalid usernames are prefixed with a tilde.
-		std::string newident(user->ident);
-		newident.insert(newident.begin(), '~');
+		std::string newuser(user->GetRealUser());
+		newuser.insert(newuser.begin(), '~');
 
 		// If the username is too long then truncate it.
-		if (newident.length() > ServerInstance->Config->Limits.MaxUser)
-			newident.erase(ServerInstance->Config->Limits.MaxUser);
+		if (newuser.length() > ServerInstance->Config->Limits.MaxUser)
+			newuser.erase(ServerInstance->Config->Limits.MaxUser);
 
 		// Apply the new username.
-		user->ChangeIdent(newident);
+		user->ChangeRealUser(newuser, user->GetDisplayedUser() == user->GetRealUser());
 	}
 
 public:
 	ModuleIdent()
-		: Module(VF_VENDOR, "Allows the usernames (idents) of users to be looked up using the RFC 1413 Identification Protocol.")
+		: Module(VF_VENDOR, "Allows the usernames of users to be looked up using the RFC 1413 Identification Protocol.")
 		, socket(this, "ident-socket", ExtensionType::USER)
 		, state(this, "ident-state", ExtensionType::USER)
 	{
@@ -362,7 +362,7 @@ public:
 		{
 			if (prefixunqueried && state.Get(user) == IDENT_SKIPPED)
 			{
-				PrefixIdent(user);
+				PrefixUser(user);
 				state.Set(user, IDENT_PREFIXED);
 			}
 			return MOD_RES_PASSTHRU;
@@ -375,8 +375,8 @@ public:
 		{
 			/* Ident timeout */
 			state.Set(user, IDENT_MISSING);
-			PrefixIdent(user);
-			user->WriteNotice("*** Ident lookup timed out, using " + user->ident + " instead.");
+			PrefixUser(user);
+			user->WriteNotice("*** Ident lookup timed out, using " + user->GetRealUser() + " instead.");
 		}
 		else if (!isock->HasResult())
 		{
@@ -388,14 +388,14 @@ public:
 		else if (isock->result.empty())
 		{
 			state.Set(user, IDENT_MISSING);
-			PrefixIdent(user);
-			user->WriteNotice("*** Could not find your ident, using " + user->ident + " instead.");
+			PrefixUser(user);
+			user->WriteNotice("*** Could not find your ident, using " + user->GetRealUser() + " instead.");
 		}
 		else
 		{
 			state.Set(user, IDENT_FOUND);
-			user->ChangeIdent(isock->result);
-			user->WriteNotice("*** Found your ident, '" + user->ident + "'");
+			user->ChangeRealUser(isock->result, user->GetDisplayedUser() == user->GetRealUser());
+			user->WriteNotice("*** Found your ident, '" + user->GetRealUser() + "'");
 		}
 
 		isock->Close();
diff --git a/src/modules/m_ircv3_chghost.cpp b/src/modules/m_ircv3_chghost.cpp
index 97a09e2fc..cf1131b4f 100644
--- a/src/modules/m_ircv3_chghost.cpp
+++ b/src/modules/m_ircv3_chghost.cpp
@@ -31,14 +31,14 @@ class ModuleIRCv3ChgHost final
 	ClientProtocol::EventProvider protoevprov;
 	Monitor::API monitorapi;
 
-	void DoChgHost(User* user, const std::string& ident, const std::string& host)
+	void DoChgHost(User* user, const std::string& username, const std::string& hostname)
 	{
 		if (!(user->connected & User::CONN_NICKUSER))
 			return;
 
 		ClientProtocol::Message msg("CHGHOST", user);
-		msg.PushParamRef(ident);
-		msg.PushParamRef(host);
+		msg.PushParamRef(username);
+		msg.PushParamRef(hostname);
 		ClientProtocol::Event protoev(protoevprov, msg);
 		IRCv3::WriteNeighborsWithCap res(user, protoev, cap, true);
 		Monitor::WriteWatchersWithCap(monitorapi, user, protoev, cap, res.GetAlreadySentId());
@@ -53,14 +53,14 @@ public:
 	{
 	}
 
-	void OnChangeIdent(User* user, const std::string& newident) override
+	void OnChangeUser(User* user, const std::string& newuser) override
 	{
-		DoChgHost(user, newident, user->GetDisplayedHost());
+		DoChgHost(user, newuser, user->GetDisplayedHost());
 	}
 
 	void OnChangeHost(User* user, const std::string& newhost) override
 	{
-		DoChgHost(user, user->ident, newhost);
+		DoChgHost(user, user->GetDisplayedUser(), newhost);
 	}
 };
 
diff --git a/src/modules/m_ldapauth.cpp b/src/modules/m_ldapauth.cpp
index c74140f9c..6f5efbc2b 100644
--- a/src/modules/m_ldapauth.cpp
+++ b/src/modules/m_ldapauth.cpp
@@ -428,7 +428,7 @@ public:
 		}
 		else
 		{
-			what = attribute + "=" + (useusername ? user->ident : user->nick);
+			what = attribute + "=" + (useusername ? user->GetRealUser() : user->nick);
 		}
 
 		try
diff --git a/src/modules/m_messageflood.cpp b/src/modules/m_messageflood.cpp
index 61ce47573..d5f27f47e 100644
--- a/src/modules/m_messageflood.cpp
+++ b/src/modules/m_messageflood.cpp
@@ -231,7 +231,7 @@ private:
 	void CreateBan(Channel* channel, User* user, bool mute)
 	{
 		std::string banmask(mute ? "m:*!" : "*!");
-		banmask.append(user->GetBanIdent());
+		banmask.append(user->GetBanUser(false));
 		banmask.append("@");
 		banmask.append(user->GetDisplayedHost());
 
diff --git a/src/modules/m_namesx.cpp b/src/modules/m_namesx.cpp
index 8d19d38cb..502478b12 100644
--- a/src/modules/m_namesx.cpp
+++ b/src/modules/m_namesx.cpp
@@ -69,7 +69,6 @@ public:
 		if (!request.GetFieldIndex('f', flag_index))
 			return MOD_RES_PASSTHRU;
 
-		// #chan ident localhost insp22.test nick H@ :0 Attila
 		if (numeric.GetParams().size() <= flag_index)
 			return MOD_RES_PASSTHRU;
 
diff --git a/src/modules/m_passforward.cpp b/src/modules/m_passforward.cpp
index 14c0aaae8..842e4573e 100644
--- a/src/modules/m_passforward.cpp
+++ b/src/modules/m_passforward.cpp
@@ -51,10 +51,10 @@ public:
 	std::string FormatStr(const LocalUser* user, const std::string& format, const std::string& pass)
 	{
 		return Template::Replace(format, {
-			{ "nick",         user->nick,   },
-			{ "nickrequired", nickrequired, },
-			{ "pass",         pass,         },
-			{ "user",         user->ident,  },
+			{ "nick",         user->nick,          },
+			{ "nickrequired", nickrequired,        },
+			{ "pass",         pass,                },
+			{ "user",         user->GetRealUser(), },
 		});
 	}
 
diff --git a/src/modules/m_repeat.cpp b/src/modules/m_repeat.cpp
index 252b91296..1d62b1065 100644
--- a/src/modules/m_repeat.cpp
+++ b/src/modules/m_repeat.cpp
@@ -423,7 +423,7 @@ private:
 	void CreateBan(Channel* channel, User* user, bool mute)
 	{
 		std::string banmask(mute ? "m:*!" : "*!");
-		banmask.append(user->GetBanIdent());
+		banmask.append(user->GetBanUser(false));
 		banmask.append("@");
 		banmask.append(user->GetDisplayedHost());
 
diff --git a/src/modules/m_rline.cpp b/src/modules/m_rline.cpp
index a771823f6..ecdbbcc34 100644
--- a/src/modules/m_rline.cpp
+++ b/src/modules/m_rline.cpp
@@ -54,8 +54,8 @@ public:
 		if (lu && lu->exempt)
 			return false;
 
-		const std::string host = u->nick + "!" + u->ident + "@" + u->GetRealHost() + " " + u->GetRealName();
-		const std::string ip = u->nick + "!" + u->ident + "@" + u->GetAddress() + " " + u->GetRealName();
+		const std::string host = u->nick + "!" + u->GetRealUser() + "@" + u->GetRealHost() + " " + u->GetRealName();
+		const std::string ip = u->nick + "!" + u->GetRealUser() + "@" + u->GetAddress() + " " + u->GetRealName();
 		return (regex->IsMatch(host) || regex->IsMatch(ip));
 	}
 
diff --git a/src/modules/m_setident.cpp b/src/modules/m_setident.cpp
index f6f743a22..2fd1462cc 100644
--- a/src/modules/m_setident.cpp
+++ b/src/modules/m_setident.cpp
@@ -34,25 +34,25 @@ public:
 		: Command(Creator, "SETIDENT", 1)
 	{
 		access_needed = CmdAccess::OPERATOR;
-		syntax = { "<ident>" };
+		syntax = { "<username>" };
 	}
 
 	CmdResult Handle(User* user, const Params& parameters) override
 	{
 		if (parameters[0].size() > ServerInstance->Config->Limits.MaxUser)
 		{
-			user->WriteNotice("*** SETIDENT: Ident is too long");
+			user->WriteNotice("*** SETIDENT: Username is too long");
 			return CmdResult::FAILURE;
 		}
 
-		if (!ServerInstance->IsIdent(parameters[0]))
+		if (!ServerInstance->IsUser(parameters[0]))
 		{
-			user->WriteNotice("*** SETIDENT: Invalid characters in ident");
+			user->WriteNotice("*** SETIDENT: Invalid characters in username");
 			return CmdResult::FAILURE;
 		}
 
-		user->ChangeIdent(parameters[0]);
-		ServerInstance->SNO.WriteGlobalSno('a', "{} used SETIDENT to change their ident to '{}'", user->nick, user->ident);
+		user->ChangeDisplayedUser(parameters[0]);
+		ServerInstance->SNO.WriteGlobalSno('a', "{} used SETIDENT to change their username to '{}'", user->nick, user->GetRealUser());
 
 		return CmdResult::SUCCESS;
 	}
@@ -66,7 +66,7 @@ private:
 
 public:
 	ModuleSetIdent()
-		: Module(VF_VENDOR, "Adds the /SETIDENT command which allows server operators to change their username (ident).")
+		: Module(VF_VENDOR, "Adds the /SETIDENT command which allows server operators to change their username.")
 		, cmd(this)
 	{
 	}
diff --git a/src/modules/m_showwhois.cpp b/src/modules/m_showwhois.cpp
index 416889dcc..54a0a382b 100644
--- a/src/modules/m_showwhois.cpp
+++ b/src/modules/m_showwhois.cpp
@@ -54,9 +54,10 @@ public:
 
 	static void HandleFast(User* dest, User* src)
 	{
-		dest->WriteNotice("*** " + src->nick + " (" + src->ident + "@" +
-			src->GetHost(dest->HasPrivPermission("users/auspex")) +
-			") did a /whois on you");
+		const std::string& userhost = dest->HasPrivPermission("users/auspex")
+			? src->GetRealUserHost()
+			: src->GetUserHost();
+		dest->WriteNotice(INSP_FORMAT("{} ({}) did a /WHOIS on you", src->nick, userhost));
 	}
 
 	CmdResult Handle(User* user, const Params& parameters) override
diff --git a/src/modules/m_shun.cpp b/src/modules/m_shun.cpp
index 60c18ef32..ae0acd45c 100644
--- a/src/modules/m_shun.cpp
+++ b/src/modules/m_shun.cpp
@@ -77,7 +77,7 @@ public:
 
 		auto* find = ServerInstance->Users.Find(target, true);
 		if (find)
-			target = "*!" + find->GetBanIdent() + "@" + find->GetAddress();
+			target = "*!" + find->GetBanUser(true) + "@" + find->GetAddress();
 
 		if (parameters.size() == 1)
 		{
diff --git a/src/modules/m_spanningtree/commands.h b/src/modules/m_spanningtree/commands.h
index 2fe6f10cf..6ce65c29d 100644
--- a/src/modules/m_spanningtree/commands.h
+++ b/src/modules/m_spanningtree/commands.h
@@ -138,7 +138,7 @@ public:
 		: public CmdBuilder
 	{
 	public:
-		Builder(User* user);
+		Builder(User* user, bool real_user);
 	};
 };
 
diff --git a/src/modules/m_spanningtree/main.cpp b/src/modules/m_spanningtree/main.cpp
index 4ec4b5c79..704d23ac6 100644
--- a/src/modules/m_spanningtree/main.cpp
+++ b/src/modules/m_spanningtree/main.cpp
@@ -502,7 +502,22 @@ void ModuleSpanningTree::OnUserConnect(LocalUser* user)
 	if (sslapi)
 		sslapi->GetCertificate(user);
 
-	CommandUID::Builder(user).Broadcast();
+	CommandUID::Builder uid(user, true);
+	CommandUID::Builder olduid(user, false);
+
+	// NOTE: we can't do CommandUID::Builder(user).Broadcast() whilst
+	// we still support the 1205 protocol.
+	for (const auto* server : Utils->TreeRoot->GetChildren())
+	{
+		TreeSocket* socket = server->GetSocket();
+		if (!socket)
+			continue; // Should never happen?
+
+		if (socket->proto_version >= PROTO_INSPIRCD_4)
+			socket->WriteLine(uid);
+		else
+			socket->WriteLine(olduid);
+	}
 
 	if (user->IsOper())
 		CommandOpertype::Builder(user, user->oper).Broadcast();
@@ -578,12 +593,12 @@ void ModuleSpanningTree::OnChangeRealName(User* user, const std::string& real)
 	CmdBuilder(user, "FNAME").push_last(real).Broadcast();
 }
 
-void ModuleSpanningTree::OnChangeIdent(User* user, const std::string& ident)
+void ModuleSpanningTree::OnChangeUser(User* user, const std::string& newuser)
 {
 	if (!user->IsFullyConnected() || !IS_LOCAL(user))
 		return;
 
-	CmdBuilder(user, "FIDENT").push(ident).Broadcast();
+	CmdBuilder(user, "FIDENT").push(newuser).Broadcast();
 }
 
 void ModuleSpanningTree::OnUserPart(Membership* memb, std::string& partmessage, CUList& excepts)
diff --git a/src/modules/m_spanningtree/main.h b/src/modules/m_spanningtree/main.h
index bfdd14b1c..2c8558e78 100644
--- a/src/modules/m_spanningtree/main.h
+++ b/src/modules/m_spanningtree/main.h
@@ -189,7 +189,7 @@ public:
 	void OnChangeHost(User* user, const std::string& newhost) override;
 	void OnChangeRealHost(User* user, const std::string& newhost) override;
 	void OnChangeRealName(User* user, const std::string& real) override;
-	void OnChangeIdent(User* user, const std::string& ident) override;
+	void OnChangeUser(User* user, const std::string& newuser) override;
 	void OnUserPart(Membership* memb, std::string& partmessage, CUList& excepts) override;
 	void OnUserQuit(User* user, const std::string& reason, const std::string& oper_message) override;
 	void OnUserPostNick(User* user, const std::string& oldnick) override;
diff --git a/src/modules/m_spanningtree/netburst.cpp b/src/modules/m_spanningtree/netburst.cpp
index 3f4d2defe..24ece4557 100644
--- a/src/modules/m_spanningtree/netburst.cpp
+++ b/src/modules/m_spanningtree/netburst.cpp
@@ -283,7 +283,7 @@ void TreeSocket::SendUsers(BurstState& bs)
 		if (!user->IsFullyConnected())
 			continue;
 
-		this->WriteLine(CommandUID::Builder(user));
+		this->WriteLine(CommandUID::Builder(user, this->proto_version != PROTO_INSPIRCD_3));
 
 		if (user->IsOper())
 			this->WriteLine(CommandOpertype::Builder(user, user->oper));
diff --git a/src/modules/m_spanningtree/nick.cpp b/src/modules/m_spanningtree/nick.cpp
index daea6d236..510589fd0 100644
--- a/src/modules/m_spanningtree/nick.cpp
+++ b/src/modules/m_spanningtree/nick.cpp
@@ -42,7 +42,7 @@ CmdResult CommandNick::HandleRemote(::RemoteUser* user, Params& params)
 	{
 		// 'x' is the already existing user using the same nick as params[0]
 		// 'user' is the user trying to change nick to the in use nick
-		bool they_change = SpanningTreeUtilities::DoCollision(x, TreeServer::Get(user), newts, user->ident, user->GetAddress(), user->uuid, "NICK");
+		bool they_change = SpanningTreeUtilities::DoCollision(x, TreeServer::Get(user), newts, user->GetRealUser(), user->GetAddress(), user->uuid, "NICK");
 		if (they_change)
 		{
 			// Remote client lost, or both lost, rewrite this nick change as a change to uuid before
diff --git a/src/modules/m_spanningtree/nickcollide.cpp b/src/modules/m_spanningtree/nickcollide.cpp
index 97a63e7e3..8ac7f1048 100644
--- a/src/modules/m_spanningtree/nickcollide.cpp
+++ b/src/modules/m_spanningtree/nickcollide.cpp
@@ -38,7 +38,7 @@
  * Sends SAVEs as appropriate and forces nick change of the user 'u' if our side loses or if both lose.
  * Does not change the nick of the user that is trying to claim the nick of 'u', i.e. the "remote" user.
  */
-bool SpanningTreeUtilities::DoCollision(User* u, TreeServer* server, time_t remotets, const std::string& remoteident, const std::string& remoteip, const std::string& remoteuid, const char* collidecmd)
+bool SpanningTreeUtilities::DoCollision(User* u, TreeServer* server, time_t remotets, const std::string& remoteuser, const std::string& remoteip, const std::string& remoteuid, const char* collidecmd)
 {
 	// At this point we're sure that a collision happened, increment the counter regardless of who wins
 	ServerInstance->stats.Collisions++;
@@ -68,15 +68,15 @@ bool SpanningTreeUtilities::DoCollision(User* u, TreeServer* server, time_t remo
 	const time_t localts = u->nickchanged;
 	if (remotets != localts)
 	{
-		/* first, let's see if ident@host matches. */
-		const std::string& localident = u->ident;
+		/* first, let's see if user@host matches. */
+		const std::string& localuser = u->GetRealUser();
 		const std::string& localip = u->GetAddress();
-		bool SamePerson = (localident == remoteident)
+		bool SamePerson = (localuser == remoteuser)
 				&& (localip == remoteip);
 
 		/*
-		 * if ident@ip is equal, and theirs is newer, or
-		 * ident@ip differ, and ours is newer
+		 * if user@ip is equal, and theirs is newer, or
+		 * user@ip differ, and ours is newer
 		 */
 		if ((SamePerson && remotets < localts) || (!SamePerson && remotets > localts))
 		{
@@ -91,8 +91,8 @@ bool SpanningTreeUtilities::DoCollision(User* u, TreeServer* server, time_t remo
 	}
 
 	ServerInstance->Logs.Debug(MODNAME, "Nick collision on \"{}\" caused by {}: {}/{}/{}@{} {} <-> {}/{}/{}@{} {}", u->nick, collidecmd,
-		u->uuid, localts, u->ident, u->GetAddress(), bChangeLocal,
-		remoteuid, remotets, remoteident, remoteip, bChangeRemote);
+		u->uuid, localts, u->GetRealUser(), u->GetAddress(), bChangeLocal,
+		remoteuid, remotets, remoteuser, remoteip, bChangeRemote);
 
 	/*
 	 * Send SAVE and accept the losing client with its UID (as we know the SAVE will
diff --git a/src/modules/m_spanningtree/uid.cpp b/src/modules/m_spanningtree/uid.cpp
index d32e4a62f..68e528bb7 100644
--- a/src/modules/m_spanningtree/uid.cpp
+++ b/src/modules/m_spanningtree/uid.cpp
@@ -33,12 +33,15 @@
 CmdResult CommandUID::HandleServer(TreeServer* remoteserver, CommandBase::Params& params)
 {
 	/**
-	 *     0    1           2    3    4     5     6         7      8      9       (n-1)
-	 * UID uuid nickchanged nick host dhost ident ip.string signon +modes (modepara) :real
+	 *     0    1           2    3    4     5?     6(5)    7(6)      8(7)   9(8)   10(9)      (n-1)
+	 * UID uuid nickchanged nick host dhost [user] duser ip.string signon +modes (modepara) :real
+	 *
+	 * The `duser` field was introduced in the 1206 (v4) protocol.
 	 */
+	size_t offset = params[9][0] == '+' ? 1 : 0;
 	time_t nickchanged = ServerCommand::ExtractTS(params[1]);
-	time_t signon = ServerCommand::ExtractTS(params[7]);
-	const std::string& modestr = params[8];
+	time_t signon = ServerCommand::ExtractTS(params[7+offset]);
+	const std::string& modestr = params[8+offset];
 
 	// Check if the length of the uuid is correct and confirm the sid portion of the uuid matches the sid of the server introducing the user
 	if (params[0].length() != UIDGenerator::UUID_LENGTH || params[0].compare(0, 3, remoteserver->GetId()))
@@ -59,7 +62,7 @@ CmdResult CommandUID::HandleServer(TreeServer* remoteserver, CommandBase::Params
 	else if (collideswith)
 	{
 		// The user on this side is fully connected, handle the collision
-		bool they_change = SpanningTreeUtilities::DoCollision(collideswith, remoteserver, nickchanged, params[5], params[6], params[0], "UID");
+		bool they_change = SpanningTreeUtilities::DoCollision(collideswith, remoteserver, nickchanged, params[5], params[6+offset], params[0], "UID");
 		if (they_change)
 		{
 			// The client being introduced needs to change nick to uuid, change the nick in the message before
@@ -71,7 +74,7 @@ CmdResult CommandUID::HandleServer(TreeServer* remoteserver, CommandBase::Params
 	}
 
 	irc::sockets::sockaddrs sa(false);
-	if (!sa.from(params[6]))
+	if (!sa.from(params[6+offset]))
 		throw ProtocolException("Invalid IP address or UNIX socket path");
 
 	/* For remote users, we pass the UUID they sent to the constructor.
@@ -82,14 +85,16 @@ CmdResult CommandUID::HandleServer(TreeServer* remoteserver, CommandBase::Params
 	_new->nick = params[2];
 	_new->ChangeRealHost(params[3], false);
 	_new->ChangeDisplayedHost(params[4]);
-	_new->ident = params[5];
+	if (offset)
+		_new->ChangeRealUser(params[5], false);
+	_new->ChangeDisplayedUser(params[5+offset]);
 	_new->ChangeRemoteAddress(sa);
 	_new->ChangeRealName(params.back());
 	_new->connected = User::CONN_FULL;
 	_new->signon = signon;
 	_new->nickchanged = nickchanged;
 
-	size_t paramptr = 9;
+	size_t paramptr = 9 + offset;
 	for (const auto& modechr : modestr)
 	{
 		// Accept more '+' chars, for now
@@ -151,7 +156,6 @@ CmdResult CommandFHost::HandleRemote(RemoteUser* src, Params& params)
 	return CmdResult::SUCCESS;
 }
 
-
 CmdResult CommandFRHost::HandleRemote(RemoteUser* src, Params& params)
 {
 	src->ChangeRealHost(params[0], false);
@@ -160,7 +164,7 @@ CmdResult CommandFRHost::HandleRemote(RemoteUser* src, Params& params)
 
 CmdResult CommandFIdent::HandleRemote(RemoteUser* src, Params& params)
 {
-	src->ChangeIdent(params[0]);
+	src->ChangeDisplayedUser(params[0]);
 	return CmdResult::SUCCESS;
 }
 
@@ -170,7 +174,7 @@ CmdResult CommandFName::HandleRemote(RemoteUser* src, Params& params)
 	return CmdResult::SUCCESS;
 }
 
-CommandUID::Builder::Builder(User* user)
+CommandUID::Builder::Builder(User* user, bool real_user)
 	: CmdBuilder(TreeServer::Get(user), "UID")
 {
 	push(user->uuid);
@@ -178,7 +182,9 @@ CommandUID::Builder::Builder(User* user)
 	push(user->nick);
 	push(user->GetRealHost());
 	push(user->GetDisplayedHost());
-	push(user->ident);
+	if (real_user)
+		push(user->GetRealUser());
+	push(user->GetDisplayedUser());
 	push(user->GetAddress());
 	push_int(user->signon);
 	push(user->GetModeLetters(true));
diff --git a/src/modules/m_spanningtree/utils.h b/src/modules/m_spanningtree/utils.h
index 1887fbfa1..35b37a39d 100644
--- a/src/modules/m_spanningtree/utils.h
+++ b/src/modules/m_spanningtree/utils.h
@@ -139,7 +139,7 @@ public:
 
 	/** Handle nick collision
 	 */
-	static bool DoCollision(User* u, TreeServer* server, time_t remotets, const std::string& remoteident, const std::string& remoteip, const std::string& remoteuid, const char* collidecmd);
+	static bool DoCollision(User* u, TreeServer* server, time_t remotets, const std::string& remoteuser, const std::string& remoteip, const std::string& remoteuid, const char* collidecmd);
 
 	/** Compile a list of servers which contain members of channel c
 	 */
diff --git a/src/modules/m_watch.cpp b/src/modules/m_watch.cpp
index bf35580d8..a63489617 100644
--- a/src/modules/m_watch.cpp
+++ b/src/modules/m_watch.cpp
@@ -59,9 +59,9 @@ class CommandWatch final
 		{
 			// The away state should only be sent if the client requests away notifications for a nick but 2.0 always sends them so we do that too
 			if (target->IsAway())
-				user->WriteNumeric(RPL_NOWISAWAY, target->nick, target->ident, target->GetDisplayedHost(), target->awaytime, "is away");
+				user->WriteNumeric(RPL_NOWISAWAY, target->nick, target->GetDisplayedHost(), target->GetDisplayedHost(), target->awaytime, "is away");
 			else
-				user->WriteNumeric(RPL_NOWON, target->nick, target->ident, target->GetDisplayedHost(), target->nickchanged, "is online");
+				user->WriteNumeric(RPL_NOWON, target->nick, target->GetDisplayedHost(), target->GetDisplayedHost(), target->nickchanged, "is online");
 		}
 		else if (show_offline)
 			user->WriteNumeric(RPL_NOWOFF, nick, "*", "*", "0", "is offline");
@@ -94,7 +94,7 @@ class CommandWatch final
 
 		User* target = ServerInstance->Users.FindNick(nick, true);
 		if (target)
-			user->WriteNumeric(RPL_WATCHOFF, target->nick, target->ident, target->GetDisplayedHost(), target->nickchanged, "stopped watching");
+			user->WriteNumeric(RPL_WATCHOFF, target->nick, target->GetDisplayedHost(), target->GetDisplayedHost(), target->nickchanged, "stopped watching");
 		else
 			user->WriteNumeric(RPL_WATCHOFF, nick, "*", "*", "0", "stopped watching");
 	}
@@ -191,7 +191,7 @@ private:
 			return;
 
 		Numeric::Numeric num(numeric);
-		num.push(nick).push(user->ident).push(user->GetDisplayedHost()).push(ConvToStr(shownts)).push(numerictext);
+		num.push(nick).push(user->GetDisplayedUser()).push(user->GetDisplayedHost()).push(ConvToStr(shownts)).push(numerictext);
 		for (const auto& curr : *list)
 			curr->WriteNumeric(num);
 	}
diff --git a/src/users.cpp b/src/users.cpp
index 4fbe51321..16267a94d 100644
--- a/src/users.cpp
+++ b/src/users.cpp
@@ -129,7 +129,7 @@ const std::string& User::GetUserAddress()
 {
 	if (cached_useraddress.empty())
 	{
-		cached_useraddress = INSP_FORMAT("{}@{}", ident, GetAddress());
+		cached_useraddress = INSP_FORMAT("{}@{}", GetRealUser(), GetAddress());
 		cached_useraddress.shrink_to_fit();
 	}
 
@@ -139,7 +139,7 @@ const std::string& User::GetUserHost()
 {
 	if (cached_userhost.empty())
 	{
-		cached_userhost = INSP_FORMAT("{}@{}", ident, GetDisplayedHost());
+		cached_userhost = INSP_FORMAT("{}@{}", GetDisplayedUser(), GetDisplayedHost());
 		cached_userhost.shrink_to_fit();
 	}
 
@@ -150,7 +150,7 @@ const std::string& User::GetRealUserHost()
 {
 	if (cached_realuserhost.empty())
 	{
-		cached_realuserhost = INSP_FORMAT("{}@{}", ident, GetRealHost());
+		cached_realuserhost = INSP_FORMAT("{}@{}", GetRealUser(), GetRealHost());
 		cached_realuserhost.shrink_to_fit();
 	}
 
@@ -161,7 +161,7 @@ const std::string& User::GetMask()
 {
 	if (cached_mask.empty())
 	{
-		cached_mask = INSP_FORMAT("{}!{}@{}", nick, ident, GetDisplayedHost());
+		cached_mask = INSP_FORMAT("{}!{}@{}", nick, GetDisplayedUser(), GetDisplayedHost());
 		cached_mask.shrink_to_fit();
 	}
 
@@ -172,7 +172,7 @@ const std::string& User::GetRealMask()
 {
 	if (cached_realmask.empty())
 	{
-		cached_realmask = INSP_FORMAT("{}!{}@{}", nick, ident, GetRealHost());
+		cached_realmask = INSP_FORMAT("{}!{}@{}", nick, GetRealUser(), GetRealHost());
 		cached_realmask.shrink_to_fit();
 	}
 
@@ -190,9 +190,9 @@ LocalUser::LocalUser(int myfd, const irc::sockets::sockaddrs& clientsa, const ir
 	signon = ServerInstance->Time();
 	// The user's default nick is their UUID
 	nick = uuid;
-	ident = uuid;
 	eh.SetFd(myfd);
 	memcpy(&client_sa, &clientsa, sizeof(irc::sockets::sockaddrs));
+	ChangeRealUser(uuid, true);
 	ChangeRealHost(GetAddress(), true);
 }
 
@@ -593,10 +593,10 @@ void LocalUser::OverruleNick()
 	this->ChangeNick(this->uuid);
 }
 
-const std::string& User::GetBanIdent() const
+const std::string& User::GetBanUser(bool real) const
 {
 	static const std::string wildcard = "*";
-	return uniqueusername ? ident : wildcard;
+	return uniqueusername ? GetUser(real) : wildcard;
 }
 
 irc::sockets::cidr_mask User::GetCIDRMask() const
@@ -990,20 +990,60 @@ void User::ChangeRealHost(const std::string& host, bool resetdisplay)
 		FOREACH_MOD(OnPostChangeRealHost, (this));
 }
 
-bool User::ChangeIdent(const std::string& newident)
+void User::ChangeRealUser(const std::string& newuser, bool resetdisplay)
 {
-	if (this->ident == newident)
-		return true;
+	// If the real user is the new user and we are not resetting the
+	// display user then we have nothing to do.
+	const bool changeuser = (realuser != newuser);
+	if (!changeuser && !resetdisplay)
+		return;
+
+	// If the displayuser is not set and we are not resetting it then
+	// we need to copy it to the displayuser field.
+	if (displayuser.empty() && !resetdisplay)
+		displayuser = realuser;
 
-	FOREACH_MOD(OnChangeIdent, (this, newident));
+	// If the displayuser is the new user or we are resetting it then
+	// we clear its contents to save memory.
+	else if (displayuser == newuser || resetdisplay)
+		displayuser.clear();
+
+	// If we are just resetting the display user then we don't need to
+	// do anything else.
+	if (!changeuser)
+		return;
+
+	// Don't call the OnChangeRealUser event when initialising a user.
+	const bool initializing = realuser.empty();
+	if (!initializing)
+		FOREACH_MOD(OnChangeRealUser, (this, newuser));
+
+	realuser = newuser;
+	realuser.shrink_to_fit();
 
-	this->ident.assign(newident, 0, ServerInstance->Config->Limits.MaxUser);
-	this->ident.shrink_to_fit();
 	this->InvalidateCache();
 
-	return true;
+	// Don't call the OnPostChangeRealUser event when initialising a user.
+	if (!this->quitting && !initializing)
+		FOREACH_MOD(OnPostChangeRealUser, (this));
 }
 
+bool User::ChangeDisplayedUser(const std::string& newuser)
+{
+	if (GetDisplayedUser() == newuser)
+		return true;
+
+	FOREACH_MOD(OnChangeUser, (this, newuser));
+
+	if (realuser == newuser)
+		this->displayuser.clear();
+	else
+		this->displayuser.assign(newuser, 0, ServerInstance->Config->Limits.MaxUser);
+	this->displayuser.shrink_to_fit();
+
+	this->InvalidateCache();
+	return true;
+}
 
 void User::PurgeEmptyChannels()
 {
diff --git a/src/xline.cpp b/src/xline.cpp
index 1ddf0606f..6889665b3 100644
--- a/src/xline.cpp
+++ b/src/xline.cpp
@@ -46,7 +46,7 @@ public:
 	 */
 	XLine* Generate(time_t set_time, unsigned long duration, const std::string& source, const std::string& reason, const std::string& xline_specific_mask) override
 	{
-		IdentHostPair ih = XLineManager::IdentSplit(xline_specific_mask);
+		UserHostPair ih = XLineManager::SplitUserHost(xline_specific_mask);
 		return new GLine(set_time, duration, source, reason, ih.first, ih.second);
 	}
 };
@@ -66,7 +66,7 @@ public:
 	 */
 	XLine* Generate(time_t set_time, unsigned long duration, const std::string& source, const std::string& reason, const std::string& xline_specific_mask) override
 	{
-		IdentHostPair ih = XLineManager::IdentSplit(xline_specific_mask);
+		UserHostPair ih = XLineManager::SplitUserHost(xline_specific_mask);
 		return new ELine(set_time, duration, source, reason, ih.first, ih.second);
 	}
 };
@@ -86,7 +86,7 @@ public:
 	 */
 	XLine* Generate(time_t set_time, unsigned long duration, const std::string& source, const std::string& reason, const std::string& xline_specific_mask) override
 	{
-		IdentHostPair ih = XLineManager::IdentSplit(xline_specific_mask);
+		UserHostPair ih = XLineManager::SplitUserHost(xline_specific_mask);
 		return new KLine(set_time, duration, source, reason, ih.first, ih.second);
 	}
 };
@@ -251,14 +251,14 @@ std::vector<std::string> XLineManager::GetAllTypes()
 	return items;
 }
 
-IdentHostPair XLineManager::IdentSplit(const std::string& ident_and_host)
+UserHostPair XLineManager::SplitUserHost(const std::string& user_and_host)
 {
-	IdentHostPair n = std::make_pair<std::string, std::string>("*", "*");
-	std::string::size_type x = ident_and_host.find('@');
+	UserHostPair n = std::make_pair("*", "*");
+	std::string::size_type x = user_and_host.find('@');
 	if (x != std::string::npos)
 	{
-		n.second = ident_and_host.substr(x + 1, ident_and_host.length());
-		n.first = ident_and_host.substr(0, x);
+		n.second = user_and_host.substr(x + 1, user_and_host.length());
+		n.first = user_and_host.substr(0, x);
 		if (!n.first.length())
 			n.first.assign("*");
 		if (!n.second.length())
@@ -267,7 +267,7 @@ IdentHostPair XLineManager::IdentSplit(const std::string& ident_and_host)
 	else
 	{
 		n.first.clear();
-		n.second = ident_and_host;
+		n.second = user_and_host;
 	}
 
 	return n;
@@ -581,7 +581,7 @@ bool KLine::Matches(User* u) const
 	if (lu && lu->exempt)
 		return false;
 
-	if (InspIRCd::Match(u->ident, this->identmask, ascii_case_insensitive_map))
+	if (InspIRCd::Match(u->GetRealUser(), this->usermask, ascii_case_insensitive_map))
 	{
 		if (InspIRCd::MatchCIDR(u->GetRealHost(), this->hostmask, ascii_case_insensitive_map) ||
 			InspIRCd::MatchCIDR(u->GetAddress(), this->hostmask, ascii_case_insensitive_map))
@@ -595,7 +595,7 @@ bool KLine::Matches(User* u) const
 
 void KLine::Apply(User* u)
 {
-	DefaultApply(u, "K", this->identmask ==  "*");
+	DefaultApply(u, "K", this->usermask ==  "*");
 }
 
 bool GLine::Matches(User* u) const
@@ -604,7 +604,7 @@ bool GLine::Matches(User* u) const
 	if (lu && lu->exempt)
 		return false;
 
-	if (InspIRCd::Match(u->ident, this->identmask, ascii_case_insensitive_map))
+	if (InspIRCd::Match(u->GetRealUser(), this->usermask, ascii_case_insensitive_map))
 	{
 		if (InspIRCd::MatchCIDR(u->GetRealHost(), this->hostmask, ascii_case_insensitive_map) ||
 			InspIRCd::MatchCIDR(u->GetAddress(), this->hostmask, ascii_case_insensitive_map))
@@ -618,12 +618,12 @@ bool GLine::Matches(User* u) const
 
 void GLine::Apply(User* u)
 {
-	DefaultApply(u, "G", this->identmask == "*");
+	DefaultApply(u, "G", this->usermask == "*");
 }
 
 bool ELine::Matches(User* u) const
 {
-	if (InspIRCd::Match(u->ident, this->identmask, ascii_case_insensitive_map))
+	if (InspIRCd::Match(u->GetRealUser(), this->usermask, ascii_case_insensitive_map))
 	{
 		if (InspIRCd::MatchCIDR(u->GetRealHost(), this->hostmask, ascii_case_insensitive_map) ||
 			InspIRCd::MatchCIDR(u->GetAddress(), this->hostmask, ascii_case_insensitive_map))