stopFn := globalFtpMetrics.log(c, username)
	defer stopFn(0, err)

	if globalIAMSys.LDAPConfig.Enabled() {
		sa, _, err := globalIAMSys.getServiceAccount(context.Background(), username)
		if err != nil && !errors.Is(err, errNoSuchServiceAccount) {
			return false, err
		}
		if errors.Is(err, errNoSuchServiceAccount) {

	var lookupResult *xldap.DNSearchResult
	var targetGroups []string

	if pass == nil && key == nil {
		return nil, errAuthentication
	}

	if pass != nil {
		sa, _, err := globalIAMSys.getServiceAccount(context.Background(), user)
		if err == nil {
			if subtle.ConstantTimeCompare([]byte(sa.Credentials.SecretKey), pass) != 1 {
				return nil, errAuthentication
			}

			return &ssh.Permissions{