YT-22593: Switch to std::string for user names and co

68d8a9981ffcfca685908dd4e25c3d2171efe6a5

44 files changed, 228 insertions, 157 deletions

diff --git a/yt/yt/client/api/delegating_client.h b/yt/yt/client/api/delegating_client.h
index 1ac5ce7597..3369b70c20 100644
--- a/yt/yt/client/api/delegating_client.h
+++ b/yt/yt/client/api/delegating_client.h
@@ -423,14 +423,14 @@ public:
         (group, member, options))
 
     DELEGATE_METHOD(TFuture<TCheckPermissionResponse>, CheckPermission, (
-        const TString& user,
+        const std::string& user,
         const NYPath::TYPath& path,
         NYTree::EPermission permission,
         const TCheckPermissionOptions& options),
         (user, path, permission, options))
 
     DELEGATE_METHOD(TFuture<TCheckPermissionByAclResult>, CheckPermissionByAcl, (
-        const std::optional<TString>& user,
+        const std::optional<std::string>& user,
         NYTree::EPermission permission,
         NYTree::INodePtr acl,
         const TCheckPermissionByAclOptions& options),
@@ -712,27 +712,27 @@ public:
         (nodeAddress, options))
 
     DELEGATE_METHOD(TFuture<void>, SetUserPassword, (
-        const TString& user,
+        const std::string& user,
         const TString& currentPasswordSha256,
         const TString& newPasswordSha256,
         const TSetUserPasswordOptions& options),
         (user, currentPasswordSha256, newPasswordSha256, options))
 
     DELEGATE_METHOD(TFuture<TIssueTokenResult>, IssueToken, (
-        const TString& user,
+        const std::string& user,
         const TString& passwordSha256,
         const TIssueTokenOptions& options),
         (user, passwordSha256, options))
 
     DELEGATE_METHOD(TFuture<void>, RevokeToken, (
-        const TString& user,
+        const std::string& user,
         const TString& passwordSha256,
         const TString& tokenSha256,
         const TRevokeTokenOptions& options),
         (user, passwordSha256, tokenSha256, options))
 
     DELEGATE_METHOD(TFuture<TListUserTokensResult>, ListUserTokens, (
-        const TString& user,
+        const std::string& user,
         const TString& passwordSha256,
         const TListUserTokensOptions& options),
         (user, passwordSha256, options))
diff --git a/yt/yt/client/api/rpc_proxy/client_impl.cpp b/yt/yt/client/api/rpc_proxy/client_impl.cpp
index 2d4a4c8a35..5f3ee6a1eb 100644
--- a/yt/yt/client/api/rpc_proxy/client_impl.cpp
+++ b/yt/yt/client/api/rpc_proxy/client_impl.cpp
@@ -992,7 +992,7 @@ TFuture<void> TClient::RemoveMember(
 }
 
 TFuture<TCheckPermissionResponse> TClient::CheckPermission(
-    const TString& user,
+    const std::string& user,
     const TYPath& path,
     EPermission permission,
     const TCheckPermissionOptions& options)
@@ -1002,7 +1002,7 @@ TFuture<TCheckPermissionResponse> TClient::CheckPermission(
     auto req = proxy.CheckPermission();
     SetTimeoutOptions(*req, options);
 
-    req->set_user(user);
+    req->set_user(ToProto<TProtobufString>(user));
     req->set_path(path);
     req->set_permission(static_cast<int>(permission));
     if (options.Columns) {
@@ -1028,7 +1028,7 @@ TFuture<TCheckPermissionResponse> TClient::CheckPermission(
 }
 
 TFuture<TCheckPermissionByAclResult> TClient::CheckPermissionByAcl(
-    const std::optional<TString>& user,
+    const std::optional<std::string>& user,
     EPermission permission,
     INodePtr acl,
     const TCheckPermissionByAclOptions& options)
@@ -1039,7 +1039,7 @@ TFuture<TCheckPermissionByAclResult> TClient::CheckPermissionByAcl(
     SetTimeoutOptions(*req, options);
 
     if (user) {
-        req->set_user(*user);
+        req->set_user(ToProto<TProtobufString>(*user));
     }
     req->set_permission(static_cast<int>(permission));
     req->set_acl(ConvertToYsonString(acl).ToString());
@@ -1999,8 +1999,8 @@ TFuture<TMaintenanceCountsPerTarget> TClient::RemoveMaintenance(
         [&] (TByUser::TMine) {
             req->set_mine(true);
         },
-        [&] (const TString& user) {
-            req->set_user(user);
+        [&] (const std::string& user) {
+            req->set_user(ToProto<TProtobufString>(user));
         });
 
     req->set_supports_per_target_response(true);
@@ -2422,7 +2422,7 @@ TFuture<void> TClient::SetBundleConfig(
 }
 
 TFuture<void> TClient::SetUserPassword(
-    const TString& /*user*/,
+    const std::string& /*user*/,
     const TString& /*currentPasswordSha256*/,
     const TString& /*newPasswordSha256*/,
     const TSetUserPasswordOptions& /*options*/)
@@ -2431,7 +2431,7 @@ TFuture<void> TClient::SetUserPassword(
 }
 
 TFuture<TIssueTokenResult> TClient::IssueToken(
-    const TString& /*user*/,
+    const std::string& /*user*/,
     const TString& /*passwordSha256*/,
     const TIssueTokenOptions& /*options*/)
 {
@@ -2439,7 +2439,7 @@ TFuture<TIssueTokenResult> TClient::IssueToken(
 }
 
 TFuture<void> TClient::RevokeToken(
-    const TString& /*user*/,
+    const std::string& /*user*/,
     const TString& /*passwordSha256*/,
     const TString& /*tokenSha256*/,
     const TRevokeTokenOptions& /*options*/)
@@ -2448,7 +2448,7 @@ TFuture<void> TClient::RevokeToken(
 }
 
 TFuture<TListUserTokensResult> TClient::ListUserTokens(
-    const TString& /*user*/,
+    const std::string& /*user*/,
     const TString& /*passwordSha256*/,
     const TListUserTokensOptions& /*options*/)
 {
diff --git a/yt/yt/client/api/rpc_proxy/client_impl.h b/yt/yt/client/api/rpc_proxy/client_impl.h
index ffce8539b5..b868d7493f 100644
--- a/yt/yt/client/api/rpc_proxy/client_impl.h
+++ b/yt/yt/client/api/rpc_proxy/client_impl.h
@@ -200,13 +200,13 @@ public:
         const NApi::TRemoveMemberOptions& options) override;
 
     TFuture<TCheckPermissionResponse> CheckPermission(
-        const TString& user,
+        const std::string& user,
         const NYPath::TYPath& path,
         NYTree::EPermission permission,
         const NApi::TCheckPermissionOptions& options) override;
 
     TFuture<TCheckPermissionByAclResult> CheckPermissionByAcl(
-        const std::optional<TString>& user,
+        const std::optional<std::string>& user,
         NYTree::EPermission permission,
         NYTree::INodePtr acl,
         const NApi::TCheckPermissionByAclOptions& options) override;
@@ -491,24 +491,24 @@ public:
     // Authentication
 
     virtual TFuture<void> SetUserPassword(
-        const TString& user,
+        const std::string& user,
         const TString& currentPasswordSha256,
         const TString& newPasswordSha256,
         const TSetUserPasswordOptions& options) override;
 
     TFuture<TIssueTokenResult> IssueToken(
-        const TString& user,
+        const std::string& user,
         const TString& passwordSha256,
         const TIssueTokenOptions& options) override;
 
     TFuture<void> RevokeToken(
-        const TString& user,
+        const std::string& user,
         const TString& passwordSha256,
         const TString& tokenSha256,
         const TRevokeTokenOptions& options) override;
 
     TFuture<TListUserTokensResult> ListUserTokens(
-        const TString& user,
+        const std::string& user,
         const TString& passwordSha256,
         const TListUserTokensOptions& options) override;
 
diff --git a/yt/yt/client/api/security_client.cpp b/yt/yt/client/api/security_client.cpp
index 51fa33d26a..b6a178f1d0 100644
--- a/yt/yt/client/api/security_client.cpp
+++ b/yt/yt/client/api/security_client.cpp
@@ -7,7 +7,7 @@ using namespace NYTree;
 ////////////////////////////////////////////////////////////////////////////////
 
 TError TCheckPermissionResult::ToError(
-    const TString& user,
+    const std::string& user,
     EPermission permission,
     const std::optional<TString>& column) const
 {
@@ -51,7 +51,7 @@ TError TCheckPermissionResult::ToError(
     }
 }
 
-TError TCheckPermissionByAclResult::ToError(const TString &user, EPermission permission) const
+TError TCheckPermissionByAclResult::ToError(const std::string& user, EPermission permission) const
 {
     switch (Action) {
         case NSecurityClient::ESecurityAction::Allow:
diff --git a/yt/yt/client/api/security_client.h b/yt/yt/client/api/security_client.h
index 0cd6484b1e..a606229e49 100644
--- a/yt/yt/client/api/security_client.h
+++ b/yt/yt/client/api/security_client.h
@@ -33,7 +33,7 @@ struct TCheckPermissionOptions
 struct TCheckPermissionResult
 {
     TError ToError(
-        const TString& user,
+        const std::string& user,
         NYTree::EPermission permission,
         const std::optional<TString>& columns = {}) const;
 
@@ -60,7 +60,7 @@ struct TCheckPermissionByAclOptions
 
 struct TCheckPermissionByAclResult
 {
-    TError ToError(const TString& user, NYTree::EPermission permission) const;
+    TError ToError(const std::string& user, NYTree::EPermission permission) const;
 
     NSecurityClient::ESecurityAction Action;
     NSecurityClient::TSubjectId SubjectId;
@@ -129,13 +129,13 @@ struct ISecurityClient
         const TRemoveMemberOptions& options = {}) = 0;
 
     virtual TFuture<TCheckPermissionResponse> CheckPermission(
-        const TString& user,
+        const std::string& user,
         const NYPath::TYPath& path,
         NYTree::EPermission permission,
         const TCheckPermissionOptions& options = {}) = 0;
 
     virtual TFuture<TCheckPermissionByAclResult> CheckPermissionByAcl(
-        const std::optional<TString>& user,
+        const std::optional<std::string>& user,
         NYTree::EPermission permission,
         NYTree::INodePtr acl,
         const TCheckPermissionByAclOptions& options = {}) = 0;
@@ -143,24 +143,24 @@ struct ISecurityClient
     // Methods below correspond to simple authentication scheme
     // and are intended to be used on clusters without third-party tokens (e.g. Yandex blackbox).
     virtual TFuture<void> SetUserPassword(
-        const TString& user,
+        const std::string& user,
         const TString& currentPasswordSha256,
         const TString& newPasswordSha256,
         const TSetUserPasswordOptions& options) = 0;
 
     virtual TFuture<TIssueTokenResult> IssueToken(
-        const TString& user,
+        const std::string& user,
         const TString& passwordSha256,
         const TIssueTokenOptions& options) = 0;
 
     virtual TFuture<void> RevokeToken(
-        const TString& user,
+        const std::string& user,
         const TString& passwordSha256,
         const TString& tokenSha256,
         const TRevokeTokenOptions& options) = 0;
 
     virtual TFuture<TListUserTokensResult> ListUserTokens(
-        const TString& user,
+        const std::string& user,
         const TString& passwordSha256,
         const TListUserTokensOptions& options) = 0;
 };
diff --git a/yt/yt/client/driver/driver.cpp b/yt/yt/client/driver/driver.cpp
index 19a0f3bdc5..8cdc9cbe88 100644
--- a/yt/yt/client/driver/driver.cpp
+++ b/yt/yt/client/driver/driver.cpp
@@ -548,7 +548,8 @@ private:
 
         NTracing::TChildTraceContextGuard commandSpan(ConcatToString(TStringBuf("Driver:"), request.CommandName));
         NTracing::AnnotateTraceContext([&] (const auto& traceContext) {
-            traceContext->AddTag("user", request.AuthenticatedUser);
+            // TODO(babenko): switch to std::string
+            traceContext->AddTag("user", TString(request.AuthenticatedUser));
             traceContext->AddTag("request_id", request.Id);
         });
 
diff --git a/yt/yt/client/driver/driver.h b/yt/yt/client/driver/driver.h
index 75d4473b0f..4d05aedc87 100644
--- a/yt/yt/client/driver/driver.h
+++ b/yt/yt/client/driver/driver.h
@@ -49,13 +49,14 @@ struct TDriverRequest
     NYTree::IMapNodePtr Parameters;
 
     //! Name of the user issuing the request.
-    TString AuthenticatedUser = NSecurityClient::RootUserName;
+    // TODO(babenko): replace with TAuthenticationIdentity
+    std::string AuthenticatedUser = NSecurityClient::RootUserName;
 
     //! Provides an additional annotation to differentiate between
     //! various clients that authenticate via the same effective user.
-    std::optional<TString> UserTag;
+    std::optional<std::string> UserTag;
 
-    //! Filled in the context of http proxy.
+    //! Filled in the context of HTTP proxy.
     std::optional<NNet::TNetworkAddress> UserRemoteAddress;
 
     //! User token.
diff --git a/yt/yt/client/driver/etc_commands.h b/yt/yt/client/driver/etc_commands.h
index 7135ddc555..5d9e8c04b1 100644
--- a/yt/yt/client/driver/etc_commands.h
+++ b/yt/yt/client/driver/etc_commands.h
@@ -114,7 +114,7 @@ public:
     static void Register(TRegistrar registrar);
 
 private:
-    TString User;
+    std::string User;
     NYPath::TRichYPath Path;
     NYTree::EPermission Permission;
 
diff --git a/yt/yt/client/federated/client.cpp b/yt/yt/client/federated/client.cpp
index 14375369fc..4f221deedb 100644
--- a/yt/yt/client/federated/client.cpp
+++ b/yt/yt/client/federated/client.cpp
@@ -391,8 +391,8 @@ public:
     UNIMPLEMENTED_METHOD(TFuture<TPutFileToCacheResult>, PutFileToCache, (const NYPath::TYPath&, const TString&, const TPutFileToCacheOptions&));
     UNIMPLEMENTED_METHOD(TFuture<void>, AddMember, (const TString&, const TString&, const TAddMemberOptions&));
     UNIMPLEMENTED_METHOD(TFuture<void>, RemoveMember, (const TString&, const TString&, const TRemoveMemberOptions&));
-    UNIMPLEMENTED_METHOD(TFuture<TCheckPermissionResponse>, CheckPermission, (const TString&, const NYPath::TYPath&, NYTree::EPermission, const TCheckPermissionOptions&));
-    UNIMPLEMENTED_METHOD(TFuture<TCheckPermissionByAclResult>, CheckPermissionByAcl, (const std::optional<TString>&, NYTree::EPermission, NYTree::INodePtr, const TCheckPermissionByAclOptions&));
+    UNIMPLEMENTED_METHOD(TFuture<TCheckPermissionResponse>, CheckPermission, (const std::string&, const NYPath::TYPath&, NYTree::EPermission, const TCheckPermissionOptions&));
+    UNIMPLEMENTED_METHOD(TFuture<TCheckPermissionByAclResult>, CheckPermissionByAcl, (const std::optional<std::string>&, NYTree::EPermission, NYTree::INodePtr, const TCheckPermissionByAclOptions&));
     UNIMPLEMENTED_METHOD(TFuture<void>, TransferAccountResources, (const TString&, const TString&, NYTree::INodePtr, const TTransferAccountResourcesOptions&));
     UNIMPLEMENTED_METHOD(TFuture<void>, TransferPoolResources, (const TString&, const TString&, const TString&, NYTree::INodePtr, const TTransferPoolResourcesOptions&));
     UNIMPLEMENTED_METHOD(TFuture<NScheduler::TOperationId>, StartOperation, (NScheduler::EOperationType, const NYson::TYsonString&, const TStartOperationOptions&));
@@ -445,10 +445,10 @@ public:
     UNIMPLEMENTED_METHOD(TFuture<TDestroyChunkLocationsResult>, DestroyChunkLocations, (const std::string&, bool, const std::vector<TGuid>&, const TDestroyChunkLocationsOptions&));
     UNIMPLEMENTED_METHOD(TFuture<TResurrectChunkLocationsResult>, ResurrectChunkLocations, (const std::string&, const std::vector<TGuid>&, const TResurrectChunkLocationsOptions&));
     UNIMPLEMENTED_METHOD(TFuture<TRequestRestartResult>, RequestRestart, (const std::string&, const TRequestRestartOptions&));
-    UNIMPLEMENTED_METHOD(TFuture<void>, SetUserPassword, (const TString&, const TString&, const TString&, const TSetUserPasswordOptions&));
-    UNIMPLEMENTED_METHOD(TFuture<TIssueTokenResult>, IssueToken, (const TString&, const TString&, const TIssueTokenOptions&));
-    UNIMPLEMENTED_METHOD(TFuture<void>, RevokeToken, (const TString&, const TString&, const TString&, const TRevokeTokenOptions&));
-    UNIMPLEMENTED_METHOD(TFuture<TListUserTokensResult>, ListUserTokens, (const TString&, const TString&, const TListUserTokensOptions&));
+    UNIMPLEMENTED_METHOD(TFuture<void>, SetUserPassword, (const std::string&, const TString&, const TString&, const TSetUserPasswordOptions&));
+    UNIMPLEMENTED_METHOD(TFuture<TIssueTokenResult>, IssueToken, (const std::string&, const TString&, const TIssueTokenOptions&));
+    UNIMPLEMENTED_METHOD(TFuture<void>, RevokeToken, (const std::string&, const TString&, const TString&, const TRevokeTokenOptions&));
+    UNIMPLEMENTED_METHOD(TFuture<TListUserTokensResult>, ListUserTokens, (const std::string&, const TString&, const TListUserTokensOptions&));
     UNIMPLEMENTED_METHOD(TFuture<NQueryTrackerClient::TQueryId>, StartQuery, (NQueryTrackerClient::EQueryEngine, const TString&, const TStartQueryOptions&));
     UNIMPLEMENTED_METHOD(TFuture<void>, AbortQuery, (NQueryTrackerClient::TQueryId, const TAbortQueryOptions&));
     UNIMPLEMENTED_METHOD(TFuture<IUnversionedRowsetPtr>, ReadQueryResult, (NQueryTrackerClient::TQueryId, i64, const TReadQueryResultOptions&));
diff --git a/yt/yt/client/hedging/hedging.cpp b/yt/yt/client/hedging/hedging.cpp
index f8c6420e92..ca5dee6917 100644
--- a/yt/yt/client/hedging/hedging.cpp
+++ b/yt/yt/client/hedging/hedging.cpp
@@ -150,10 +150,10 @@ public:
     UNSUPPORTED_METHOD(TFuture<TPutFileToCacheResult>, PutFileToCache, (const TYPath&, const TString&, const TPutFileToCacheOptions&));
     UNSUPPORTED_METHOD(TFuture<void>, AddMember, (const TString&, const TString&, const TAddMemberOptions&));
     UNSUPPORTED_METHOD(TFuture<void>, RemoveMember, (const TString&, const TString&, const TRemoveMemberOptions&));
-    UNSUPPORTED_METHOD(TFuture<TCheckPermissionResponse>, CheckPermission, (const TString&, const TYPath&, EPermission, const TCheckPermissionOptions&));
-    UNSUPPORTED_METHOD(TFuture<TCheckPermissionByAclResult>, CheckPermissionByAcl, (const std::optional<TString>&, EPermission, INodePtr, const TCheckPermissionByAclOptions&));
-    UNSUPPORTED_METHOD(TFuture<void>, TransferAccountResources, (const TString&, const TString&, INodePtr, const TTransferAccountResourcesOptions&));
-    UNSUPPORTED_METHOD(TFuture<void>, TransferPoolResources, (const TString&, const TString&, const TString&, INodePtr, const TTransferPoolResourcesOptions&));
+    UNSUPPORTED_METHOD(TFuture<TCheckPermissionResponse>, CheckPermission, (const std::string&, const TYPath&, NYTree::EPermission, const TCheckPermissionOptions&));
+    UNSUPPORTED_METHOD(TFuture<TCheckPermissionByAclResult>, CheckPermissionByAcl, (const std::optional<std::string>&, NYTree::EPermission, NYTree::INodePtr, const TCheckPermissionByAclOptions&));
+    UNSUPPORTED_METHOD(TFuture<void>, TransferAccountResources, (const TString&, const TString&, NYTree::INodePtr, const TTransferAccountResourcesOptions&));
+    UNSUPPORTED_METHOD(TFuture<void>, TransferPoolResources, (const TString&, const TString&, const TString&, NYTree::INodePtr, const TTransferPoolResourcesOptions&));
     UNSUPPORTED_METHOD(TFuture<NScheduler::TOperationId>, StartOperation, (NScheduler::EOperationType, const NYson::TYsonString&, const TStartOperationOptions&));
     UNSUPPORTED_METHOD(TFuture<void>, AbortOperation, (const NScheduler::TOperationIdOrAlias&, const TAbortOperationOptions&));
     UNSUPPORTED_METHOD(TFuture<void>, SuspendOperation, (const NScheduler::TOperationIdOrAlias&, const TSuspendOperationOptions&));
@@ -206,10 +206,10 @@ public:
     UNSUPPORTED_METHOD(TFuture<TResurrectChunkLocationsResult>, ResurrectChunkLocations, (const std::string&, const std::vector<TGuid>&, const TResurrectChunkLocationsOptions&));
     UNSUPPORTED_METHOD(TFuture<TRequestRestartResult>, RequestRestart, (const std::string&, const TRequestRestartOptions&));
     UNSUPPORTED_METHOD(TFuture<TPullRowsResult>, PullRows, (const TYPath&, const TPullRowsOptions&));
-    UNSUPPORTED_METHOD(TFuture<void>, SetUserPassword, (const TString&, const TString&, const TString&, const TSetUserPasswordOptions&));
-    UNSUPPORTED_METHOD(TFuture<TIssueTokenResult>, IssueToken, (const TString&, const TString&, const TIssueTokenOptions&));
-    UNSUPPORTED_METHOD(TFuture<void>, RevokeToken, (const TString&, const TString&, const TString&, const TRevokeTokenOptions&));
-    UNSUPPORTED_METHOD(TFuture<TListUserTokensResult>, ListUserTokens, (const TString&, const TString&, const TListUserTokensOptions&));
+    UNSUPPORTED_METHOD(TFuture<void>, SetUserPassword, (const std::string&, const TString&, const TString&, const TSetUserPasswordOptions&));
+    UNSUPPORTED_METHOD(TFuture<TIssueTokenResult>, IssueToken, (const std::string&, const TString&, const TIssueTokenOptions&));
+    UNSUPPORTED_METHOD(TFuture<void>, RevokeToken, (const std::string&, const TString&, const TString&, const TRevokeTokenOptions&));
+    UNSUPPORTED_METHOD(TFuture<TListUserTokensResult>, ListUserTokens, (const std::string&, const TString&, const TListUserTokensOptions&));
     UNSUPPORTED_METHOD(TFuture<NQueryTrackerClient::TQueryId>, StartQuery, (NQueryTrackerClient::EQueryEngine, const TString&, const TStartQueryOptions&));
     UNSUPPORTED_METHOD(TFuture<void>, AbortQuery, (NQueryTrackerClient::TQueryId, const TAbortQueryOptions&));
     UNSUPPORTED_METHOD(TFuture<TQueryResult>, GetQueryResult, (NQueryTrackerClient::TQueryId, i64, const TGetQueryResultOptions&));
diff --git a/yt/yt/client/security_client/helpers.cpp b/yt/yt/client/security_client/helpers.cpp
index 1ac9b7c11d..88df829c05 100644
--- a/yt/yt/client/security_client/helpers.cpp
+++ b/yt/yt/client/security_client/helpers.cpp
@@ -10,7 +10,7 @@ using namespace NYPath;
 
 ////////////////////////////////////////////////////////////////////////////////
 
-TYPath GetUserPath(const TString& name)
+TYPath GetUserPath(const std::string& name)
 {
     return "//sys/users/" + ToYPathLiteral(name);
 }
diff --git a/yt/yt/client/security_client/helpers.h b/yt/yt/client/security_client/helpers.h
index 8f361b3aaa..650b1341d9 100644
--- a/yt/yt/client/security_client/helpers.h
+++ b/yt/yt/client/security_client/helpers.h
@@ -11,7 +11,7 @@ namespace NYT::NSecurityClient {
 
 ////////////////////////////////////////////////////////////////////////////////
 
-NYPath::TYPath GetUserPath(const TString& name);
+NYPath::TYPath GetUserPath(const std::string& name);
 NYPath::TYPath GetGroupPath(const TString& name);
 NYPath::TYPath GetAccountPath(const TString& name);
 
diff --git a/yt/yt/client/table_client/helpers-inl.h b/yt/yt/client/table_client/helpers-inl.h
index 0231b1c21f..a4e39d7a6c 100644
--- a/yt/yt/client/table_client/helpers-inl.h
+++ b/yt/yt/client/table_client/helpers-inl.h
@@ -59,6 +59,7 @@ XX(TDuration)
 
 XX(TString)
 XX(TStringBuf)
+XX(std::string)
 XX(TGuid)
 
 #undef XX
diff --git a/yt/yt/client/table_client/helpers.cpp b/yt/yt/client/table_client/helpers.cpp
index 2298c932d1..882aee2b8a 100644
--- a/yt/yt/client/table_client/helpers.cpp
+++ b/yt/yt/client/table_client/helpers.cpp
@@ -464,6 +464,25 @@ void FromUnversionedValue(TString* value, TUnversionedValue unversionedValue)
 
 void ToUnversionedValue(
     TUnversionedValue* unversionedValue,
+    const std::string& value,
+    const TRowBufferPtr& rowBuffer,
+    int id,
+    EValueFlags flags)
+{
+    ToUnversionedValue(unversionedValue, static_cast<TStringBuf>(value), rowBuffer, id, flags);
+}
+
+void FromUnversionedValue(std::string* value, TUnversionedValue unversionedValue)
+{
+    TStringBuf uncapturedValue;
+    FromUnversionedValue(&uncapturedValue, unversionedValue);
+    *value = std::string(uncapturedValue);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+void ToUnversionedValue(
+    TUnversionedValue* unversionedValue,
     TStringBuf value,
     const TRowBufferPtr& rowBuffer,
     int id,
@@ -475,7 +494,7 @@ void ToUnversionedValue(
 void FromUnversionedValue(TStringBuf* value, TUnversionedValue unversionedValue)
 {
     if (unversionedValue.Type == EValueType::Null) {
-        *value = TStringBuf{};
+        *value = {};
         return;
     }
     if (unversionedValue.Type != EValueType::String) {
@@ -489,6 +508,18 @@ void FromUnversionedValue(TStringBuf* value, TUnversionedValue unversionedValue)
 
 void ToUnversionedValue(
     TUnversionedValue* unversionedValue,
+    std::string_view value,
+    const TRowBufferPtr& rowBuffer,
+    int id,
+    EValueFlags flags)
+{
+    *unversionedValue = rowBuffer->CaptureValue(MakeUnversionedStringValue(TStringBuf(value), id, flags));
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+void ToUnversionedValue(
+    TUnversionedValue* unversionedValue,
     const char* value,
     const TRowBufferPtr& rowBuffer,
     int id,
diff --git a/yt/yt/client/table_client/helpers.h b/yt/yt/client/table_client/helpers.h
index cb0e131199..b86124557e 100644
--- a/yt/yt/client/table_client/helpers.h
+++ b/yt/yt/client/table_client/helpers.h
@@ -76,6 +76,9 @@ void FromUnversionedValue(TString* value, TUnversionedValue unversionedValue);
 void ToUnversionedValue(TUnversionedValue* unversionedValue, TStringBuf value, const TRowBufferPtr& rowBuffer, int id = 0, EValueFlags flags = EValueFlags::None);
 void FromUnversionedValue(TStringBuf* value, TUnversionedValue unversionedValue);
 
+void ToUnversionedValue(TUnversionedValue* unversionedValue, const std::string& value, const TRowBufferPtr& rowBuffer, int id = 0, EValueFlags flags = EValueFlags::None);
+void FromUnversionedValue(std::string* value, TUnversionedValue unversionedValue);
+
 void ToUnversionedValue(TUnversionedValue* unversionedValue, const char* value, const TRowBufferPtr& rowBuffer, int id = 0, EValueFlags flags = EValueFlags::None);
 void FromUnversionedValue(const char** value, TUnversionedValue unversionedValue);
 
diff --git a/yt/yt/client/unittests/mock/client.h b/yt/yt/client/unittests/mock/client.h
index 906e4427b3..f6290bded7 100644
--- a/yt/yt/client/unittests/mock/client.h
+++ b/yt/yt/client/unittests/mock/client.h
@@ -534,14 +534,14 @@ public:
         (override));
 
     MOCK_METHOD(TFuture<TCheckPermissionResponse>, CheckPermission, (
-        const TString& user,
+        const std::string& user,
         const NYPath::TYPath& path,
         NYTree::EPermission permission,
         const TCheckPermissionOptions& options),
         (override));
 
     MOCK_METHOD(TFuture<TCheckPermissionByAclResult>, CheckPermissionByAcl, (
-        const std::optional<TString>& user,
+        const std::optional<std::string>& user,
         NYTree::EPermission permission,
         NYTree::INodePtr acl,
         const TCheckPermissionByAclOptions& options),
@@ -704,27 +704,27 @@ public:
         (override));
 
     MOCK_METHOD(TFuture<void>, SetUserPassword, (
-        const TString& user,
+        const std::string& user,
         const TString& currentPasswordSha256,
         const TString& newPasswordSha256,
         const TSetUserPasswordOptions& options),
         (override));
 
     MOCK_METHOD(TFuture<TIssueTokenResult>, IssueToken, (
-        const TString& user,
+        const std::string& user,
         const TString& passwordSha256,
         const TIssueTokenOptions& options),
         (override));
 
     MOCK_METHOD(TFuture<void>, RevokeToken, (
-        const TString& user,
+        const std::string& user,
         const TString& passwordSha256,
         const TString& tokenSha256,
         const TRevokeTokenOptions& options),
         (override));
 
     MOCK_METHOD(TFuture<TListUserTokensResult>, ListUserTokens, (
-        const TString& user,
+        const std::string& user,
         const TString& passwordSha256,
         const TListUserTokensOptions& options),
         (override));
diff --git a/yt/yt/core/rpc/authentication_identity.cpp b/yt/yt/core/rpc/authentication_identity.cpp
index 17aec51d46..aa2ba58349 100644
--- a/yt/yt/core/rpc/authentication_identity.cpp
+++ b/yt/yt/core/rpc/authentication_identity.cpp
@@ -11,9 +11,9 @@ using namespace NYTree;
 
 ////////////////////////////////////////////////////////////////////////////////
 
-TAuthenticationIdentity::TAuthenticationIdentity(TString user, TString userTag)
-    : User(std::move(user))
-    , UserTag(std::move(userTag))
+TAuthenticationIdentity::TAuthenticationIdentity(const std::string& user, const std::string& userTag)
+    : User(user)
+    , UserTag(userTag)
 { }
 
 void Serialize(const TAuthenticationIdentity& identity, IYsonConsumer* consumer)
@@ -63,7 +63,7 @@ void SetCurrentAuthenticationIdentity(const TAuthenticationIdentity* identity)
 void FormatValue(TStringBuilderBase* builder, const TAuthenticationIdentity& value, TStringBuf /*spec*/)
 {
     builder->AppendFormat("{User: %v", value.User);
-    if (!value.UserTag.Empty() && value.UserTag != value.User) {
+    if (!value.UserTag.empty() && value.UserTag != value.User) {
         builder->AppendFormat(", UserTag: %v", value.UserTag);
     }
     builder->AppendChar('}');
diff --git a/yt/yt/core/rpc/authentication_identity.h b/yt/yt/core/rpc/authentication_identity.h
index d1b7ff8b1a..964a178642 100644
--- a/yt/yt/core/rpc/authentication_identity.h
+++ b/yt/yt/core/rpc/authentication_identity.h
@@ -13,12 +13,13 @@ namespace NYT::NRpc {
 struct TAuthenticationIdentity
 {
     TAuthenticationIdentity() = default;
-    explicit TAuthenticationIdentity(TString user, TString userTag = {});
+    explicit TAuthenticationIdentity(const std::string& user, const std::string& userTag = {});
 
     bool operator==(const TAuthenticationIdentity& other) const = default;
 
-    TString User;
-    TString UserTag;
+    // TODO(babenko): consider wrapping with std::optional
+    std::string User;
+    std::string UserTag;
 };
 
 //! Returns the current identity.
diff --git a/yt/yt/core/rpc/authenticator.cpp b/yt/yt/core/rpc/authenticator.cpp
index e054b40d6a..95a732011e 100644
--- a/yt/yt/core/rpc/authenticator.cpp
+++ b/yt/yt/core/rpc/authenticator.cpp
@@ -70,9 +70,9 @@ public:
         static const auto Realm = TString("noop");
         static const auto UserTicket = TString();
         TAuthenticationResult result{
-            context.Header->has_user() ? FromProto<TString>(context.Header->user()) : RootUserName,
+            context.Header->has_user() ? FromProto<std::string>(context.Header->user()) : RootUserName,
             Realm,
-            UserTicket
+            UserTicket,
         };
         return MakeFuture<TAuthenticationResult>(result);
     }
diff --git a/yt/yt/core/rpc/authenticator.h b/yt/yt/core/rpc/authenticator.h
index 3648e23c2b..f08ac411fa 100644
--- a/yt/yt/core/rpc/authenticator.h
+++ b/yt/yt/core/rpc/authenticator.h
@@ -12,7 +12,7 @@ namespace NYT::NRpc {
 
 struct TAuthenticationResult
 {
-    TString User;
+    std::string User;
     TString Realm;
     TString UserTicket;
 };
diff --git a/yt/yt/core/rpc/client.cpp b/yt/yt/core/rpc/client.cpp
index 9beb0c3bf6..b212dcdbb0 100644
--- a/yt/yt/core/rpc/client.cpp
+++ b/yt/yt/core/rpc/client.cpp
@@ -220,22 +220,22 @@ void TClientRequest::RequireServerFeature(int featureId)
     Header_.add_required_server_feature_ids(featureId);
 }
 
-const TString& TClientRequest::GetUser() const
+const std::string& TClientRequest::GetUser() const
 {
     return User_;
 }
 
-void TClientRequest::SetUser(const TString& user)
+void TClientRequest::SetUser(const std::string& user)
 {
     User_ = user;
 }
 
-const TString& TClientRequest::GetUserTag() const
+const std::string& TClientRequest::GetUserTag() const
 {
     return UserTag_;
 }
 
-void TClientRequest::SetUserTag(const TString& tag)
+void TClientRequest::SetUserTag(const std::string& tag)
 {
     UserTag_ = tag;
 }
diff --git a/yt/yt/core/rpc/client.h b/yt/yt/core/rpc/client.h
index 97a01be51e..b87559933a 100644
--- a/yt/yt/core/rpc/client.h
+++ b/yt/yt/core/rpc/client.h
@@ -63,11 +63,11 @@ struct IClientRequest
     virtual void DeclareClientFeature(int featureId) = 0;
     virtual void RequireServerFeature(int featureId) = 0;
 
-    virtual const TString& GetUser() const = 0;
-    virtual void SetUser(const TString& user) = 0;
+    virtual const std::string& GetUser() const = 0;
+    virtual void SetUser(const std::string& user) = 0;
 
-    virtual const TString& GetUserTag() const = 0;
-    virtual void SetUserTag(const TString& tag) = 0;
+    virtual const std::string& GetUserTag() const = 0;
+    virtual void SetUserTag(const std::string& tag) = 0;
 
     virtual void SetUserAgent(const TString& userAgent) = 0;
 
@@ -175,11 +175,11 @@ public:
     void DeclareClientFeature(int featureId) override;
     void RequireServerFeature(int featureId) override;
 
-    const TString& GetUser() const override;
-    void SetUser(const TString& user) override;
+    const std::string& GetUser() const override;
+    void SetUser(const std::string& user) override;
 
-    const TString& GetUserTag() const override;
-    void SetUserTag(const TString& tag) override;
+    const std::string& GetUserTag() const override;
+    void SetUserTag(const std::string& tag) override;
 
     void SetUserAgent(const TString& userAgent) override;
 
diff --git a/yt/yt/core/rpc/grpc/channel.cpp b/yt/yt/core/rpc/grpc/channel.cpp
index dbdd5bfb07..55f803519d 100644
--- a/yt/yt/core/rpc/grpc/channel.cpp
+++ b/yt/yt/core/rpc/grpc/channel.cpp
@@ -285,9 +285,11 @@ private:
                 NYT::Ref(Tracer_.Get());
             }
             InitialMetadataBuilder_.Add(RequestIdMetadataKey, ToString(Request_->GetRequestId()));
-            InitialMetadataBuilder_.Add(UserMetadataKey, Request_->GetUser());
-            if (Request_->GetUserTag()) {
-                InitialMetadataBuilder_.Add(UserTagMetadataKey, Request_->GetUserTag());
+            // TODO(babenko): switch to std::string
+            InitialMetadataBuilder_.Add(UserMetadataKey, TString(Request_->GetUser()));
+            if (!Request_->GetUserTag().empty()) {
+                // TODO(babenko): switch to std::string
+                InitialMetadataBuilder_.Add(UserTagMetadataKey, TString(Request_->GetUserTag()));
             }
 
             TProtocolVersion protocolVersion{
diff --git a/yt/yt/core/rpc/helpers-inl.h b/yt/yt/core/rpc/helpers-inl.h
index aa66c5513a..efda191282 100644
--- a/yt/yt/core/rpc/helpers-inl.h
+++ b/yt/yt/core/rpc/helpers-inl.h
@@ -6,6 +6,8 @@
 
 #include "authentication_identity.h"
 
+#include <yt/yt/core/misc/protobuf_helpers.h>
+
 namespace NYT::NRpc {
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -13,24 +15,28 @@ namespace NYT::NRpc {
 template <class T>
 void WriteAuthenticationIdentityToProto(T* proto, const TAuthenticationIdentity& identity)
 {
+    using NYT::ToProto;
+
     if (identity.User == RootUserName) {
         proto->clear_user();
     } else {
-        proto->set_user(identity.User);
+        proto->set_user(ToProto<TProtobufString>(identity.User));
     }
     if (identity.UserTag == identity.User) {
         proto->clear_user_tag();
     } else {
-        proto->set_user_tag(identity.UserTag);
+        proto->set_user_tag(ToProto<TProtobufString>(identity.UserTag));
     }
 }
 
 template <class T>
 TAuthenticationIdentity ParseAuthenticationIdentityFromProto(const T& proto)
 {
+    using NYT::FromProto;
+
     TAuthenticationIdentity identity;
-    identity.User = proto.has_user() ? proto.user() : RootUserName;
-    identity.UserTag = proto.has_user_tag() ? proto.user_tag () : identity.User;
+    identity.User = proto.has_user() ? FromProto<std::string>(proto.user()) : RootUserName;
+    identity.UserTag = proto.has_user_tag() ? FromProto<std::string>(proto.user_tag()) : identity.User;
     return identity;
 }
 
diff --git a/yt/yt/core/rpc/http/channel.cpp b/yt/yt/core/rpc/http/channel.cpp
index dfcf8b1e73..8b868d9d71 100644
--- a/yt/yt/core/rpc/http/channel.cpp
+++ b/yt/yt/core/rpc/http/channel.cpp
@@ -173,7 +173,7 @@ private:
             : Client_(client)
         {
             TSharedRef httpRequestBody;
-            THeadersPtr httpRequestHeaders = TranslateRequest(request);
+            auto httpRequestHeaders = TranslateRequest(request);
 
             auto protocol = parentChannel->IsHttps_ ? "https" : "http";
             // See TServer::DoRegisterService().
@@ -235,11 +235,12 @@ private:
         }
 
     private:
-        IClientPtr Client_;
+        const IClientPtr Client_;
+
         TFuture<IResponsePtr> Response_;
 
         // This function does the backwards transformation of NRpc::NHttp::THttpHandler::TranslateRequest().
-        THeadersPtr TranslateRequest(IClientRequestPtr& request)
+        THeadersPtr TranslateRequest(const IClientRequestPtr& request)
         {
             using namespace NHeaders;
             using NYT::FromProto;
@@ -305,12 +306,14 @@ private:
                 httpHeaders->Add(UserAgentHeaderName, rpcHeader.user_agent());
             }
 
-            if (auto& user = request->GetUser()) {
-                httpHeaders->Add(UserNameHeaderName, user);
+            if (const auto& user = request->GetUser(); !user.empty()) {
+                // TODO(babenko): switch to std:::string
+                httpHeaders->Add(UserNameHeaderName, TString(user));
             }
 
-            if (auto& user_tag = request->GetUserTag()) {
-                httpHeaders->Add(UserTagHeaderName, user_tag);
+            if (const auto& userTag = request->GetUserTag(); !userTag.empty()) {
+                // TODO(babenko): switch to std:::string
+                httpHeaders->Add(UserTagHeaderName, TString(userTag));
             }
 
             if (rpcHeader.has_timeout()) {
diff --git a/yt/yt/core/rpc/per_user_request_queue_provider.cpp b/yt/yt/core/rpc/per_user_request_queue_provider.cpp
index 04080fede7..13ce89e0ae 100644
--- a/yt/yt/core/rpc/per_user_request_queue_provider.cpp
+++ b/yt/yt/core/rpc/per_user_request_queue_provider.cpp
@@ -29,7 +29,7 @@ TRequestQueue* TPerUserRequestQueueProvider::GetQueue(const NProto::TRequestHead
     return DoGetQueue(userName);
 }
 
-TRequestQueue* TPerUserRequestQueueProvider::DoGetQueue(const TString& userName)
+TRequestQueue* TPerUserRequestQueueProvider::DoGetQueue(const std::string& userName)
 {
     auto queue = RequestQueues_.FindOrInsert(userName, [&] {
         auto queue = CreateRequestQueue(userName, ThrottlerProfiler_);
@@ -107,7 +107,7 @@ void TPerUserRequestQueueProvider::ReconfigureAllUsers()
     });
 }
 
-void TPerUserRequestQueueProvider::ReconfigureUser(const TString& userName)
+void TPerUserRequestQueueProvider::ReconfigureUser(const std::string& userName)
 {
     if (!ReconfigurationCallback_) {
         return;
diff --git a/yt/yt/core/rpc/per_user_request_queue_provider.h b/yt/yt/core/rpc/per_user_request_queue_provider.h
index 6ee4eaa356..84a3b0389c 100644
--- a/yt/yt/core/rpc/per_user_request_queue_provider.h
+++ b/yt/yt/core/rpc/per_user_request_queue_provider.h
@@ -17,9 +17,9 @@ class TPerUserRequestQueueProvider
     : public TRequestQueueProviderBase
 {
 public:
-    using TReconfigurationCallback = std::function<void(TString, TRequestQueuePtr)>;
+    using TReconfigurationCallback = std::function<void(const std::string, const TRequestQueuePtr&)>;
 
-    TPerUserRequestQueueProvider(
+    explicit TPerUserRequestQueueProvider(
         TReconfigurationCallback reconfigurationCallback = {},
         NProfiling::TProfiler throttlerProfiler = {});
 
@@ -27,17 +27,17 @@ public:
     TRequestQueue* GetQueue(const NProto::TRequestHeader& header) override;
     void ConfigureQueue(TRequestQueue* queue, const TMethodConfigPtr& config) override;
 
-    void ReconfigureUser(const TString& userName);
+    void ReconfigureUser(const std::string& userName);
     void ReconfigureAllUsers();
 
     void UpdateThrottlingEnabledFlags(bool enableWeightThrottling, bool enableBytesThrottling);
     void UpdateDefaultConfigs(const TRequestQueueThrottlerConfigs& configs);
 
 private:
-    TRequestQueue* DoGetQueue(const TString& userName);
+    TRequestQueue* DoGetQueue(const std::string& userName);
     std::pair<bool, bool> ReadThrottlingEnabledFlags();
 
-    NConcurrency::TSyncMap<TString, TRequestQueuePtr> RequestQueues_;
+    NConcurrency::TSyncMap<std::string, TRequestQueuePtr> RequestQueues_;
 
     TAtomicObject<TRequestQueueThrottlerConfigs> DefaultConfigs_;
 
diff --git a/yt/yt/core/rpc/public.cpp b/yt/yt/core/rpc/public.cpp
index ab082251c3..e8edfe126b 100644
--- a/yt/yt/core/rpc/public.cpp
+++ b/yt/yt/core/rpc/public.cpp
@@ -8,7 +8,7 @@ const TRequestId NullRequestId;
 const TRealmId NullRealmId;
 const TMutationId NullMutationId;
 
-const TString RootUserName("root");
+const std::string RootUserName("root");
 
 const TString RequestIdAnnotation("rpc.request_id");
 const TString EndpointAnnotation("rpc.endpoint");
diff --git a/yt/yt/core/rpc/public.h b/yt/yt/core/rpc/public.h
index db2adda4b1..45f6b44a82 100644
--- a/yt/yt/core/rpc/public.h
+++ b/yt/yt/core/rpc/public.h
@@ -142,7 +142,7 @@ extern const TRealmId NullRealmId;
 using TMutationId = TGuid;
 extern const TMutationId NullMutationId;
 
-extern const TString RootUserName;
+extern const std::string RootUserName;
 
 constexpr int TypicalMessagePartCount = 8;
 
diff --git a/yt/yt/core/rpc/retrying_channel.cpp b/yt/yt/core/rpc/retrying_channel.cpp
index 196cb9c3ee..b43dab5fa4 100644
--- a/yt/yt/core/rpc/retrying_channel.cpp
+++ b/yt/yt/core/rpc/retrying_channel.cpp
@@ -310,12 +310,12 @@ private:
                 Request_->GetService(),
                 Request_->GetMethod(),
                 MakeFormatterWrapper([&] (auto* builder) {
-                    if (Request_->GetUser()) {
+                    if (!Request_->GetUser().empty()) {
                         builder->AppendFormat("User: %v, ", Request_->GetUser());
                     }
                 }),
                 MakeFormatterWrapper([&] (auto* builder) {
-                    if (Request_->GetUserTag() && Request_->GetUserTag() != Request_->GetUser()) {
+                    if (!Request_->GetUserTag().empty() && Request_->GetUserTag() != Request_->GetUser()) {
                         builder->AppendFormat("UserTag: %v, ", Request_->GetUserTag());
                     }
                 }),
diff --git a/yt/yt/core/rpc/service_detail.cpp b/yt/yt/core/rpc/service_detail.cpp
index 71ce934e04..16175e8a88 100644
--- a/yt/yt/core/rpc/service_detail.cpp
+++ b/yt/yt/core/rpc/service_detail.cpp
@@ -54,9 +54,10 @@ constexpr auto ServiceLivenessCheckPeriod = TDuration::MilliSeconds(100);
 
 ////////////////////////////////////////////////////////////////////////////////
 
-TRequestQueuePtr CreateRequestQueue(TString name, const NProfiling::TProfiler& profiler)
+TRequestQueuePtr CreateRequestQueue(const std::string& name, const NProfiling::TProfiler& profiler)
 {
-    return New<TRequestQueue>(name, profiler.WithTag("user", name));
+    // TODO(babenko): migrate to std::string
+    return New<TRequestQueue>(name, profiler.WithTag("user", TString(name)));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -1110,10 +1111,10 @@ private:
         if (TraceContext_ && TraceContext_->IsRecorded()) {
             TraceContext_->AddTag(RequestInfoAnnotation, logMessage);
             const auto& authenticationIdentity = GetAuthenticationIdentity();
-            if (authenticationIdentity.User) {
+            if (!authenticationIdentity.User.empty()) {
                 TStringBuilder builder;
                 builder.AppendString(authenticationIdentity.User);
-                if (authenticationIdentity.UserTag && authenticationIdentity.UserTag != authenticationIdentity.User) {
+                if (!authenticationIdentity.UserTag.empty() && authenticationIdentity.UserTag != authenticationIdentity.User) {
                     builder.AppendChar(':');
                     builder.AppendString(authenticationIdentity.UserTag);
                 }
@@ -1306,8 +1307,8 @@ private:
 
 ////////////////////////////////////////////////////////////////////////////////
 
-TRequestQueue::TRequestQueue(TString name, NProfiling::TProfiler profiler)
-    : Name_(std::move(name))
+TRequestQueue::TRequestQueue(const std::string& name, NProfiling::TProfiler profiler)
+    : Name_(name)
     , BytesThrottler_{CreateReconfigurableThroughputThrottler(InfiniteRequestThrottlerConfig,
         NLogging::TLogger(),
         profiler.WithPrefix("/bytes_throttler"))}
@@ -1375,7 +1376,7 @@ void TRequestQueue::Configure(const TMethodConfigPtr& config)
     SubscribeToThrottlers();
 }
 
-const TString& TRequestQueue::GetName() const
+const std::string& TRequestQueue::GetName() const
 {
     return Name_;
 }
@@ -1874,7 +1875,7 @@ void TServiceBase::OnRequestAuthenticated(
                 return;
             }
         }
-        requestHeader.set_user(std::move(authResult.User));
+        requestHeader.set_user(ToProto<TProtobufString>(authResult.User));
 
         auto* credentialsExt = requestHeader.MutableExtension(
             NRpc::NProto::TCredentialsExt::credentials_ext);
@@ -1947,7 +1948,8 @@ void TServiceBase::RegisterRequestQueue(
 
     auto profiler = runtimeInfo->Profiler.WithSparse();
     if (runtimeInfo->Descriptor.RequestQueueProvider) {
-        profiler = profiler.WithTag("queue", requestQueue->GetName());
+        // TODO(babenko): switch to std::string
+        profiler = profiler.WithTag("queue", TString(requestQueue->GetName()));
     }
     profiler.AddFuncGauge("/request_queue_size", MakeStrong(this), [=] {
         return requestQueue->GetQueueSize();
@@ -2340,10 +2342,12 @@ TServiceBase::TMethodPerformanceCountersPtr TServiceBase::CreateMethodPerformanc
 
     auto profiler = runtimeInfo->Profiler.WithSparse();
     if (userTag) {
+        // TODO(babenko): switch to std::string
         profiler = profiler.WithTag("user", TString(userTag));
     }
     if (runtimeInfo->Descriptor.RequestQueueProvider) {
-        profiler = profiler.WithTag("queue", requestQueue->GetName());
+        // TODO(babenko): switch to std::string
+        profiler = profiler.WithTag("queue", TString(requestQueue->GetName()));
     }
     return New<TMethodPerformanceCounters>(profiler, TimeHistogramConfig_.Acquire());
 }
diff --git a/yt/yt/core/rpc/service_detail.h b/yt/yt/core/rpc/service_detail.h
index 3057ab77ae..19c64c0359 100644
--- a/yt/yt/core/rpc/service_detail.h
+++ b/yt/yt/core/rpc/service_detail.h
@@ -466,7 +466,9 @@ protected:
 
 ////////////////////////////////////////////////////////////////////////////////
 
-TRequestQueuePtr CreateRequestQueue(TString name, const NProfiling::TProfiler& profiler = {});
+TRequestQueuePtr CreateRequestQueue(
+    const std::string& name,
+    const NProfiling::TProfiler& profiler = {});
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -1082,7 +1084,7 @@ class TRequestQueue
     : public TRefCounted
 {
 public:
-    explicit TRequestQueue(TString name, NProfiling::TProfiler profiler);
+    TRequestQueue(const std::string& name, NProfiling::TProfiler profiler);
 
     bool Register(TServiceBase* service, TServiceBase::TRuntimeMethodInfo* runtimeInfo);
     void Configure(const TMethodConfigPtr& config);
@@ -1101,10 +1103,11 @@ public:
     void ConfigureWeightThrottler(const NConcurrency::TThroughputThrottlerConfigPtr& config);
     void ConfigureBytesThrottler(const NConcurrency::TThroughputThrottlerConfigPtr& config);
 
-    const TString& GetName() const;
+    const std::string& GetName() const;
 
 private:
-    const TString Name_;
+    const std::string Name_;
+
     YT_DECLARE_SPIN_LOCK(NThreading::TSpinLock, RegisterLock_);
     std::atomic<bool> Registered_ = false;
     TServiceBase* Service_;
diff --git a/yt/yt/core/yson/pull_parser_deserialize.cpp b/yt/yt/core/yson/pull_parser_deserialize.cpp
index 3659fd29fb..ac775436af 100644
--- a/yt/yt/core/yson/pull_parser_deserialize.cpp
+++ b/yt/yt/core/yson/pull_parser_deserialize.cpp
@@ -85,7 +85,16 @@ void Deserialize(double& value, TYsonPullParserCursor* cursor)
     }
 }
 
-// TString.
+// std::string
+void Deserialize(std::string& value, TYsonPullParserCursor* cursor)
+{
+    MaybeSkipAttributes(cursor);
+    EnsureYsonToken("string", *cursor, EYsonItemType::StringValue);
+    value = (*cursor)->UncheckedAsString();
+    cursor->Next();
+}
+
+// TString
 void Deserialize(TString& value, TYsonPullParserCursor* cursor)
 {
     MaybeSkipAttributes(cursor);
diff --git a/yt/yt/core/yson/pull_parser_deserialize.h b/yt/yt/core/yson/pull_parser_deserialize.h
index 9d10f5f47c..5f6215180b 100644
--- a/yt/yt/core/yson/pull_parser_deserialize.h
+++ b/yt/yt/core/yson/pull_parser_deserialize.h
@@ -67,6 +67,9 @@ void Deserialize(unsigned long long& value, TYsonPullParserCursor* cursor);
 // double
 void Deserialize(double& value, TYsonPullParserCursor* cursor);
 
+// std::string
+void Deserialize(std::string& value, TYsonPullParserCursor* cursor);
+
 // TString
 void Deserialize(TString& value, TYsonPullParserCursor* cursor);
 
diff --git a/yt/yt/core/ytree/ypath_client.cpp b/yt/yt/core/ytree/ypath_client.cpp
index 62e65d04ca..7a4cd258bd 100644
--- a/yt/yt/core/ytree/ypath_client.cpp
+++ b/yt/yt/core/ytree/ypath_client.cpp
@@ -87,22 +87,22 @@ void TYPathRequest::RequireServerFeature(int featureId)
     Header_.add_required_server_feature_ids(featureId);
 }
 
-const TString& TYPathRequest::GetUser() const
+const std::string& TYPathRequest::GetUser() const
 {
     YT_ABORT();
 }
 
-void TYPathRequest::SetUser(const TString& /*user*/)
+void TYPathRequest::SetUser(const std::string& /*user*/)
 {
     YT_ABORT();
 }
 
-const TString& TYPathRequest::GetUserTag() const
+const std::string& TYPathRequest::GetUserTag() const
 {
     YT_ABORT();
 }
 
-void TYPathRequest::SetUserTag(const TString& /*tag*/)
+void TYPathRequest::SetUserTag(const std::string& /*tag*/)
 {
     YT_ABORT();
 }
diff --git a/yt/yt/core/ytree/ypath_client.h b/yt/yt/core/ytree/ypath_client.h
index 0e163bb696..2f9fc916e4 100644
--- a/yt/yt/core/ytree/ypath_client.h
+++ b/yt/yt/core/ytree/ypath_client.h
@@ -39,11 +39,11 @@ public:
     void DeclareClientFeature(int featureId) override;
     void RequireServerFeature(int featureId) override;
 
-    const TString& GetUser() const override;
-    void SetUser(const TString& user) override;
+    const std::string& GetUser() const override;
+    void SetUser(const std::string& user) override;
 
-    const TString& GetUserTag() const override;
-    void SetUserTag(const TString& tag) override;
+    const std::string& GetUserTag() const override;
+    void SetUserTag(const std::string& tag) override;
 
     void SetUserAgent(const TString& userAgent) override;
 
diff --git a/yt/yt/core/ytree/ypath_detail.cpp b/yt/yt/core/ytree/ypath_detail.cpp
index 679f0f6fea..128f671623 100644
--- a/yt/yt/core/ytree/ypath_detail.cpp
+++ b/yt/yt/core/ytree/ypath_detail.cpp
@@ -253,7 +253,7 @@ void TSupportsMultisetAttributes::SetAttributes(
 void TSupportsPermissions::ValidatePermission(
     EPermissionCheckScope /*scope*/,
     EPermission /*permission*/,
-    const TString& /*user*/)
+    const std::string& /*user*/)
 { }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -265,7 +265,7 @@ TSupportsPermissions::TCachingPermissionValidator::TCachingPermissionValidator(
     , Scope_(scope)
 { }
 
-void TSupportsPermissions::TCachingPermissionValidator::Validate(EPermission permission, const TString& user)
+void TSupportsPermissions::TCachingPermissionValidator::Validate(EPermission permission, const std::string& user)
 {
     auto& validatedPermissions = ValidatedPermissions_[user];
     if (None(validatedPermissions & permission)) {
diff --git a/yt/yt/core/ytree/ypath_detail.h b/yt/yt/core/ytree/ypath_detail.h
index 694b767be4..797fff24d1 100644
--- a/yt/yt/core/ytree/ypath_detail.h
+++ b/yt/yt/core/ytree/ypath_detail.h
@@ -245,7 +245,8 @@ protected:
     virtual void ValidatePermission(
         EPermissionCheckScope scope,
         EPermission permission,
-        const TString& user = {});
+        // TODO(babenko): replace with optional
+        const std::string& user = {});
 
     class TCachingPermissionValidator
     {
@@ -254,7 +255,7 @@ protected:
             TSupportsPermissions* owner,
             EPermissionCheckScope scope);
 
-        void Validate(EPermission permission, const TString& user = {});
+        void Validate(EPermission permission, const std::string& user = {});
 
     private:
         TSupportsPermissions* const Owner_;
diff --git a/yt/yt/core/ytree/ypath_service.cpp b/yt/yt/core/ytree/ypath_service.cpp
index 16d400780a..b5b901dcda 100644
--- a/yt/yt/core/ytree/ypath_service.cpp
+++ b/yt/yt/core/ytree/ypath_service.cpp
@@ -905,10 +905,10 @@ class TPermissionValidatingYPathService
 public:
     TPermissionValidatingYPathService(
         IYPathServicePtr underlyingService,
-        TCallback<void(const TString&, EPermission)> validationCallback)
+        TPermissionValidator validator)
         : UnderlyingService_(std::move(underlyingService))
-        , ValidationCallback_(std::move(validationCallback))
-        , PermissionValidator_(this, EPermissionCheckScope::This)
+        , Validator_(std::move(validator))
+        , CachingPermissionValidator_(this, EPermissionCheckScope::This)
     { }
 
     TResolveResult Resolve(
@@ -925,30 +925,30 @@ public:
 
 private:
     const IYPathServicePtr UnderlyingService_;
-    const TCallback<void(const TString&, EPermission)> ValidationCallback_;
+    const TPermissionValidator Validator_;
 
-    TCachingPermissionValidator PermissionValidator_;
+    TCachingPermissionValidator CachingPermissionValidator_;
 
     void ValidatePermission(
         EPermissionCheckScope /*scope*/,
         EPermission permission,
-        const TString& user) override
+        const std::string& user) override
     {
-        ValidationCallback_.Run(user, permission);
+        Validator_.Run(user, permission);
     }
 
     bool DoInvoke(const IYPathServiceContextPtr& context) override
     {
         // TODO(max42): choose permission depending on method.
-        PermissionValidator_.Validate(EPermission::Read, context->GetAuthenticationIdentity().User);
+        CachingPermissionValidator_.Validate(EPermission::Read, context->GetAuthenticationIdentity().User);
         ExecuteVerb(UnderlyingService_, context);
         return true;
     }
 };
 
-IYPathServicePtr IYPathService::WithPermissionValidator(TCallback<void(const TString&, EPermission)> validationCallback)
+IYPathServicePtr IYPathService::WithPermissionValidator(TPermissionValidator validator)
 {
-    return New<TPermissionValidatingYPathService>(this, std::move(validationCallback));
+    return New<TPermissionValidatingYPathService>(this, std::move(validator));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/yt/yt/core/ytree/ypath_service.h b/yt/yt/core/ytree/ypath_service.h
index d294da6d01..d0ea869e8f 100644
--- a/yt/yt/core/ytree/ypath_service.h
+++ b/yt/yt/core/ytree/ypath_service.h
@@ -142,9 +142,10 @@ struct IYPathService
         IInvokerPtr workerInvoker,
         const NProfiling::TProfiler& profiler = {});
 
+    using TPermissionValidator = TCallback<void(const std::string& user, EPermission permission)>;
     //! Creates a wrapper that calls given callback on each invocation
     //! in order to validate user permission to query the ypath service.
-    IYPathServicePtr WithPermissionValidator(TCallback<void(const TString&, EPermission)> validationCallback);
+    IYPathServicePtr WithPermissionValidator(TPermissionValidator validator);
 
 protected:
     //! Implementation method for WriteAttributesFragment.
diff --git a/yt/yt/library/auth/authentication_options.cpp b/yt/yt/library/auth/authentication_options.cpp
index 2d72e2a359..7cfdf0f92d 100644
--- a/yt/yt/library/auth/authentication_options.cpp
+++ b/yt/yt/library/auth/authentication_options.cpp
@@ -8,7 +8,7 @@ namespace NYT::NAuth {
 
 ////////////////////////////////////////////////////////////////////////////////
 
-TAuthenticationOptions TAuthenticationOptions::FromUser(const TString& user, const std::optional<TString>& userTag)
+TAuthenticationOptions TAuthenticationOptions::FromUser(const std::string& user, const std::optional<std::string>& userTag)
 {
     return {
         .User = user,
@@ -24,7 +24,7 @@ TAuthenticationOptions TAuthenticationOptions::FromAuthenticationIdentity(const
 TAuthenticationOptions TAuthenticationOptions::FromToken(const TString& token)
 {
     return {
-        .Token = token
+        .Token = token,
     };
 }
 
@@ -38,13 +38,13 @@ TAuthenticationOptions TAuthenticationOptions::FromServiceTicketAuth(const IServ
 TAuthenticationOptions TAuthenticationOptions::FromUserTicket(const TString& userTicket)
 {
     return {
-        .UserTicket = userTicket
+        .UserTicket = userTicket,
     };
 }
 
-const TString& TAuthenticationOptions::GetAuthenticatedUser() const
+const std::string& TAuthenticationOptions::GetAuthenticatedUser() const
 {
-    static const TString UnknownUser("<unknown>");
+    static const std::string UnknownUser("<unknown>");
     return User ? *User : UnknownUser;
 }
 
diff --git a/yt/yt/library/auth/authentication_options.h b/yt/yt/library/auth/authentication_options.h
index 7b7072e5a3..155fc8eeb7 100644
--- a/yt/yt/library/auth/authentication_options.h
+++ b/yt/yt/library/auth/authentication_options.h
@@ -14,24 +14,24 @@ namespace NYT::NAuth {
 
 struct TAuthenticationOptions
 {
-    static TAuthenticationOptions FromUser(const TString& user, const std::optional<TString>& userTag = {});
+    static TAuthenticationOptions FromUser(const std::string& user, const std::optional<std::string>& userTag = {});
     static TAuthenticationOptions FromAuthenticationIdentity(const NRpc::TAuthenticationIdentity& identity);
     static TAuthenticationOptions FromToken(const TString& token);
     static TAuthenticationOptions FromServiceTicketAuth(const IServiceTicketAuthPtr& ticketAuth);
     static TAuthenticationOptions FromUserTicket(const TString& userTicket);
 
-    const TString& GetAuthenticatedUser() const;
+    const std::string& GetAuthenticatedUser() const;
     NRpc::TAuthenticationIdentity GetAuthenticationIdentity() const;
 
     //! This field is not required for authentication.
     //! When not specified, user is derived from credentials. When
     //! specified, server additionally checks that #User is
     //! matching user derived from credentials.
-    std::optional<TString> User;
+    std::optional<std::string> User;
 
     //! Provides an additional annotation to differentiate between
     //! various clients that authenticate via the same effective user.
-    std::optional<TString> UserTag;
+    std::optional<std::string> UserTag;
 
     std::optional<TString> Token;
     std::optional<TString> SessionId;
diff --git a/yt/yt/library/tracing/jaeger/sampler.cpp b/yt/yt/library/tracing/jaeger/sampler.cpp
index e77b60e767..d33623f532 100644
--- a/yt/yt/library/tracing/jaeger/sampler.cpp
+++ b/yt/yt/library/tracing/jaeger/sampler.cpp
@@ -51,14 +51,15 @@ TSampler::TSampler(
     , TracesSampled_(Profiler_.Counter("/traces_sampled"))
 { }
 
-void TSampler::SampleTraceContext(const TString& user, const TTraceContextPtr& traceContext)
+void TSampler::SampleTraceContext(const std::string& user, const TTraceContextPtr& traceContext)
 {
     auto config = Config_.Acquire();
 
     auto [userState, inserted] = Users_.FindOrInsert(user, [&] {
         auto state = New<TUserState>();
 
-        auto profiler = Profiler_.WithSparse().WithTag("user", user);
+        // TODO(babenko): switch to std::string
+        auto profiler = Profiler_.WithSparse().WithTag("user", TString(user));
         state->TracesSampledByUser = profiler.Counter("/traces_sampled_by_user");
         state->TracesSampledByProbability = profiler.Counter("/traces_sampled_by_probability");
 
diff --git a/yt/yt/library/tracing/jaeger/sampler.h b/yt/yt/library/tracing/jaeger/sampler.h
index 1ae7563040..f6ed7359b5 100644
--- a/yt/yt/library/tracing/jaeger/sampler.h
+++ b/yt/yt/library/tracing/jaeger/sampler.h
@@ -49,7 +49,7 @@ public:
         TSamplerConfigPtr config = New<TSamplerConfig>(),
         const NProfiling::TProfiler& profiler = TracingProfiler());
 
-    void SampleTraceContext(const TString& user, const TTraceContextPtr& traceContext);
+    void SampleTraceContext(const std::string& user, const TTraceContextPtr& traceContext);
 
     void UpdateConfig(TSamplerConfigPtr config);