})
		if err != nil {
			c.Fatalf("export %d: Unable to attach policy: %v", caseNum, err)
		}
	}

	for groupDN, policies := range content.ldapGroupPolicyMappings {
		_, err := s.adm.AttachPolicyLDAP(ctx, madmin.PolicyAssociationReq{
			Policies: policies,
			Group:    groupDN,
		})
		if err != nil {
			c.Fatalf("export %d: Unable to attach group policy: %v", caseNum, err)
		}
	}

			iamLogIf(ctx, err)
			return
		}
		if dn == "" {
			// Still attempt to detach if provided user is a DN.
			if !isAttach && sys.LDAPConfig.IsLDAPUserDN(r.User) {
				dn = r.User
			} else {
				err = errNoSuchUser
				return
			}
		}
		isGroup = false
	} else {
		if isAttach {
			var foundGroupDN string
			var underBaseDN bool

		HTTPStatusCode: http.StatusNotFound,
	},
	ErrPolicyAlreadyAttached: {
		Code:           "XMinioPolicyAlreadyAttached",
		Description:    "The specified policy is already attached.",
		HTTPStatusCode: http.StatusConflict,
	},
	ErrPolicyNotAttached: {
		Code:           "XMinioPolicyNotAttached",
		Description:    "The specified policy is not found.",

	existingPolicySet := mp.policySet()
	policiesToUpdate := set.CreateStringSet(policies...)
	var newPolicySet set.StringSet
	newPolicyMapping := mp
	if isAttach {
		// new policies to attach => inputPolicies - existing (set difference)
		policiesToUpdate = policiesToUpdate.Difference(existingPolicySet)
		// validate that new policies to add are defined.

		return
	}

	operation := mux.Vars(r)["operation"]
	if operation != "attach" && operation != "detach" {
		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminInvalidArgument), r.URL)
		return
	}
	isAttach := operation == "attach"

	password := cred.SecretKey
	reqBytes, err := madmin.DecryptData(password, io.LimitReader(r.Body, r.ContentLength))