when(mock.getSubject()).thenReturn(subject);
            doNothing().when(mock).login();
        })) {
            KerberosCredentials credentials = new KerberosCredentials(LOGIN_CONTEXT_NAME);
            assertNotNull(credentials.getSubject());
            assertEquals(subject, credentials.getSubject());
        }
    }

    /**
     * Test constructor when login fails.

        this.cachedSubject = null;
    }

    @Override
    public synchronized Subject getSubject() {
        if (this.cachedSubject != null) {
            return this.cachedSubject;
        }

        try {
            log.debug("Logging on");
            LoginContext lc;

            Subject ps = super.getSubject();

            if (this.configuration != null) {

     */
    public KerberosCredentials(String loginContextName) throws LoginException {
        LoginContext lc = new LoginContext(loginContextName);
        lc.login();
        this.subject = lc.getSubject();
    }

    /**
     * Retrieves all Kerberos keys from the authenticated subject.
     *
     * @return array of KerberosKey objects
     */
    public KerberosKey[] getKeys() {

    /**
     * Get the security subject associated with these credentials.
     * @return subject associated with the credentials
     */
    Subject getSubject();

    /**
     * Refresh the credentials.
     * @throws CIFSException if refresh fails
     */
    void refresh() throws CIFSException;

                throws SmbException {
            // Not used within these tests
            throw new SmbException("not used in tests");
        }

        @Override
        public Subject getSubject() {
            return null; // not relevant for renew() behavior
        }

        @Override
        public void refresh() throws CIFSException {
            // no-op for tests
        }

        @Override

```json
cat > getonly.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
	{
	  "Action": [
		"s3:GetObject"
	  ],
	  "Effect": "Allow",
	  "Resource": [
		"arn:aws:s3:::my-bucketname/*"
	  ],
	  "Sid": ""
	}
  ]
}
EOF
```

Create new canned policy by name `getonly` using `getonly.json` policy file.

	if err != nil {
		log.Fatalln(err)
	}

	var opts minio.GetObjectOptions

	// Add extract header to request:
	opts.Set("x-minio-extract", "true")

	// Download API.md from the archive
	rd, err := s3Client.GetObject(context.Background(), "your-bucket", "path/to/file.zip/data.csv", opts)
	if err != nil {
		log.Fatalln(err)
	}
	_, err = io.Copy(os.Stdout, rd)
	if err != nil {
		log.Fatalln(err)
	}

```
20:09:10.216 [200 OK] s3.GetObject veeam-minio01:9000/vbo/Veeam/Backup365/vbotest/Organizations/6571606ecbc4455dbfe23b83f6f45597/Webs/ca2d0986229b4ec88e3a217ef8f04a1d/Items/efaa67764b304e77badb213d131beab6/f4f0cf600f494c3eb702d8eafe0fabcc.aac07493e6cd4c71845d2495a4e1e19b 139.178.68.158    9.789ms      ↑ 90 B ↓ 8.5 KiB

   ],
   "Resource": [
    "arn:aws:s3:::bucket"
   ]
  },
  {
   "Effect": "Allow",
   "Action": [
    "s3:GetReplicationConfiguration",
    "s3:ReplicateTags",
    "s3:AbortMultipartUpload",
    "s3:GetObject",
    "s3:GetObjectVersion",
    "s3:GetObjectVersionTagging",
    "s3:PutObject",
    "s3:DeleteObject",
    "s3:ReplicateObject",
    "s3:ReplicateDelete"
   ],
   "Resource": [
    "arn:aws:s3:::bucket/*"

## How to enable Fan-Out Uploads ?