method: http.MethodPost,
			path:   kmsKeyCreatePath,
			query:  map[string]string{"key-id": "new-test-key"},
			asRoot: false,

			wantStatusCode: http.StatusForbidden,
			wantResp:       []string{"AccessDenied"},
		},
		{
			name:   "create key as user with no resources specified want success",
			method: http.MethodPost,
			path:   kmsKeyCreatePath,
			query:  map[string]string{"key-id": "new-test-key"},

			secretKey:          "",
			expectedRespStatus: http.StatusForbidden,
			lifecycleResponse:  []byte(""),
			errorResponse: APIErrorResponse{
				Resource: SlashSeparator + bucketName + SlashSeparator,
				Code:     "AccessDenied",
				Message:  "Access Denied.",
			},
			shouldPass: false,
		},
		// GET wrong credentials
		{
			method: http.MethodGet, bucketName: bucketName,
			accessKey:          "abcd",

     * Log the access denied activity.
     * @param user The user.
     * @param path The path.
     */
    public void accessDenied(final OptionalThing<FessUserBean> user, final String path) {
        final Map<String, String> valueMap = new LinkedHashMap<>();
        valueMap.put("action", Action.ACCESS_DENIED.name());
        valueMap.put("user", user.map(FessUserBean::getUserId).orElse("-"));
        valueMap.put("path", path);

	if err != nil {
		switch minio.ToErrorResponse(err).Code {
		case "NoSuchBucket":
			return BucketRemoteTargetNotFound{Bucket: tgt.TargetBucket, Err: err}
		case "AccessDenied":
			return RemoteTargetConnectionErr{Bucket: tgt.TargetBucket, AccessKey: tgt.Credentials.AccessKey, Err: err}
		}
		return RemoteTargetConnectionErr{Bucket: tgt.TargetBucket, AccessKey: tgt.Credentials.AccessKey, Err: err}

        };
    }

    private ActivityHelper createSpyActivityHelper(final List<Map<String, String>> capturedLogs) {
        return new ActivityHelper() {
            @Override
            public void accessDenied(final OptionalThing<FessUserBean> user, final String path) {
                final Map<String, String> log = new LinkedHashMap<>();
                log.put("user", user.map(FessUserBean::getUserId).orElse("-"));

		return
	}

	getObjectInfo := objectAPI.GetObjectInfo

	// Check for auth type to return S3 compatible error.
	// type to return the correct error (NoSuchKey vs AccessDenied)
	if s3Error := checkRequestAuthType(ctx, r, policy.GetObjectAction, bucket, zipPath); s3Error != ErrNone {
		if getRequestAuthType(r) == authTypeAnonymous {
			// As per "Permission" section in

    @Test
    public void test_accessDenied() {
        activityHelper.useEcsFormat = false;
        activityHelper.accessDenied(OptionalThing.empty(), "/admin/user/");
        assertEquals("action:ACCESS_DENIED\tuser:-\tpath:/admin/user/", localLogMsg.get());

        activityHelper.accessDenied(createUser("testuser", new String[0]), "/admin/user/");

			err = ObjectNotFound{Bucket: bucket, Object: object, VersionID: versionID}
		} else {
			err = BucketNotFound{Bucket: bucket}
		}
	case "XMinioInvalidObjectName":
		err = ObjectNameInvalid{}
	case "AccessDenied":
		err = PrefixAccessDenied{
			Bucket: bucket,
			Object: object,
		}
	case "XAmzContentSHA256Mismatch":
		err = hash.SHA256Mismatch{}
	case "NoSuchUpload":
		err = InvalidUploadID{}

    public ActionResponse godHandPrologue(final ActionRuntime runtime) {
        try {
            return superGodHandPrologue(runtime);
        } catch (final UserRoleLoginException e) {
            activityHelper.accessDenied(getUserBean(), runtime.getRequestPath());
            return redirect(e.getActionClass());
        }
    }

    /**
     * Calls the parent's godHandPrologue method.
     * <p>

        initialContext.put("host", "server.example.com");
        initialContext.put("port", 445);

        exception = new SmbOperationException(SmbOperationException.ErrorCode.ACCESS_DENIED, "Permission denied", null,
                SmbOperationException.RetryPolicy.DEFAULT, initialContext);

        // When
        exception.withContext("path", "/share/file.txt").withContext("user", "testuser");