The UserBadge constructor validates that the identifier is not empty and does not exceed MAX_USERNAME_LENGTH.

However, when using $identifierNormalizer, the normalized identifier is computed lazily in getUserIdentifier() without validation. This allows normalizers to return invalid values:

// This correctly triggers a deprecation in the constructor
new UserBadge(''); 

// This currently bypasses validation and returns an empty string
$badge = new UserBadge('valid_input', null, null, fn() => ''); 
$badge->getUserIdentifier(); 

Related to #51744 and #61183

I targeted 7.3 as it introduced identifierNormalizer, please let me know if I should target 8.0 or 8.1 instead.