The returned user's DN and their password are then verified with the LDAP server. The user DN may also be associated with an [access policy](#managing-usergroup-access-policy).

The User DN attributes configuration parameter:
```
MINIO_IDENTITY_LDAP_USER_DN_ATTRIBUTES      (list)      "," separated list of user DN attributes e.g. "uid,cn,mail,sshPublicKey"
```

		}) {
			writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAccessDenied), r.URL)
			return
		}
	} else if len(dnList) == 1 {
		var dn string
		foundResult, err := globalIAMSys.LDAPConfig.GetValidatedDNForUsername(dnList[0])
		if err == nil {
			dn = foundResult.NormDN
		}
		if dn == cred.ParentUser || dnList[0] == cred.ParentUser {
			selfOnly = true
		}
	}

	if !globalIAMSys.IsAllowed(policy.Args{

¹ô‡‰O/>§MetaSys ¼x-minio-internal-inline-dataÄ true§MetaUsr‚¬content-type­text/markdown¤etagÙ 4af243ccccbadaf12545¡vÎeçnÐδg»Ä ¤nullÅ%uûc¿“êíûO á §hÁ¿ÂÄ·Î,2ù ÞV² 6R6u2·¾ çò] „ ]iyýYVa~v„ yûJEØέ¡ µXiA[5¦dN@^Í ¯µA~eMýªi}d g )Õv mý…vMFe¯Õ~c›?ª~^tBK’1•_VIwY¸÷s`”SU©¤ ‹' ñmwON¾ MhzÕ}ªd Ð{œ™¡û=M°sR_eô*Kºim¿ðñ)cKÖ»`w~h]» ûzq]»oeRa{®}Úk ãh'wg­œ¸Ž–Œ ;/²XDBbÕÔ£­* æœ~Yuý%r°C[S»Ö÷is`g 1}gp i»³ ·# Tqc}~Gi% `nÄÐ{œ™¡ûué&Ojg}nFO&ûo½æËìaK£XqCïR_K7Y ,Fñ 0±›lPÃïÝ-²ø* BIÜï1#_^^uB¸å7i¹}û,W{•[ixU !v\YF—ÃýËF}J- › 3)%ÄÌ1±3‰c`...

	issClaim = "iss"

	// JWT claim to check the parent user
	parentClaim = "parent"

	// LDAP claim keys
	ldapUser       = "ldapUser"       // this is a key name for a normalized DN value
	ldapActualUser = "ldapActualUser" // this is a key name for the actual DN value
	ldapUserN      = "ldapUsername"   // this is a key name for the short/login username
	// Claim key-prefix for LDAP attributes
	ldapAttribPrefix = "ldapAttrib_"