Reported by Clemens Brunner:

When passing a domain-qualified username like DOMAIN\user or DOMAIN/user to smbc_set_credentials_with_fallback(), the domain prefix was previously stored as part of the username. This caused authentication failures on DFS shares where the target server is different from the entry-point server, because those connections use the context-level credentials directly and would try to authenticate as the literal string DOMAIN\user with no domain set. I've stumbled upon this behavior using Dolphin (with the Samba part in KIO-Extras) and initially tried to fix it there (https://invent.kde.org/network/kio-extras/-/merge_requests/517), but I think the fix belongs here.
This patch splits the username on \, /, or the configured winbind separator, storing the domain and username in their respective credential fields (this mirrors what cli_session_creds_init() already does for initial connections). If the caller explicitly supplied a non-default workgroup, that value takes precedence over any domain embedded in the username.