}

            @Override
            public String toDisplayString() {
                return "DOMAIN\\" + accountName;
            }

            @Override
            public String getAccountName() {
                return accountName;
            }

            @Override
            public String getDomainName() {
                return "DOMAIN";
            }

			AccountName:     cred.AccessKey,
			Groups:          cred.Groups,
			Action:          policy.BypassGovernanceRetentionAction,
			BucketName:      bucketName,
			ObjectName:      objectName,
			ConditionValues: conditions,
			IsOwner:         owner,
			Claims:          cred.Claims,
		})
	}
	if globalIAMSys.IsAllowed(policy.Args{
		AccountName:     cred.AccessKey,

	// If listing is requested for a specific user (who is not the request
	// sender), check that the user has permissions.
	if userDN != "" && userDN != cred.ParentUser {
		if !globalIAMSys.IsAllowed(policy.Args{
			AccountName:     cred.AccessKey,
			Groups:          cred.Groups,
			Action:          policy.ListServiceAccountsAdminAction,
			ConditionValues: getConditionValues(r, "", cred),
			IsOwner:         owner,

func checkKMSActionAllowed(r *http.Request, owner bool, cred auth.Credentials, action policy.KMSAction, resource string) bool {
	return globalIAMSys.IsAllowed(policy.Args{
		AccountName:     cred.AccessKey,
		Groups:          cred.Groups,
		Action:          policy.Action(action),
		ConditionValues: getConditionValues(r, "", cred),
		IsOwner:         owner,
		Claims:          cred.Claims,

                /*
                 * Session Setup And X Request / Response
                 */

                if (LogStream.level >= 4) {
                    SmbTransport.log.println("sessionSetup: accountName=" + auth.username + ",primaryDomain=" + auth.domain);
                }

                /* We explicitly set uid to 0 here to prevent a new
                 * SMB_COM_SESSION_SETUP_ANDX from having it's uid set to an

			AccessKey: claims.AccessKey,
			Claims:    claims.Map(),
			Groups:    groups,
		}

		// For authenticated users apply IAM policy.
		if !globalIAMSys.IsAllowed(policy.Args{
			AccountName:     cred.AccessKey,
			Groups:          cred.Groups,
			Action:          policy.PrometheusAdminAction,
			ConditionValues: getConditionValues(r, "", cred),
			IsOwner:         owner,
			Claims:          cred.Claims,

        void testNamesByType() {
            byte[] ident = new byte[] { 0, 0, 0, 0, 0, 5 };
            // Unknown: domainName derived from numeric SID, accountName = RID
            SID unknown = new SID(buildSidT((byte) 1, ident, 10, 20, 30), jcifs.SID.SID_TYPE_UNKNOWN, null, null, false);
            assertEquals("S-1-5-10-20", unknown.getDomainName());