// such a case, is a security issue. Ideally, we should not allow such
	// behavior, but for compatibility with the Console, we currently allow it.
	//
	// TODO:
	//
	// 1. fix console behavior and allow this inheritance for service accounts
	// created before a certain (TBD) future date.
	//
	// 2. do not allow empty statement policies for service accounts.

				suite.TestLDAPSTSServiceAccountsWithUsername(c)
				suite.TestLDAPSTSServiceAccountsWithGroups(c)
				suite.TearDownSuite(c)
			},
		)
	}
}

// This test is for a fix added to handle non-normalized base DN values in the
// LDAP configuration. It runs the existing LDAP sub-tests with a non-normalized
// LDAP configuration.
func TestIAMWithLDAPNonNormalizedBaseDNConfigServerSuite(t *testing.T) {

		// is not inlined to make sure we return correct errors
		// during HeadObject().

		// Healing must not come here and return error, since healing
		// deals with dataDirs directly, let healing fix things automatically.
		if lerr := Access(pathJoin(volumeDir, path, fi.DataDir)); lerr != nil {
			if os.IsNotExist(lerr) {
				// Data dir is missing we must return errFileCorrupted
				return FileInfo{}, errFileCorrupt

	return decodeVersions(buf, versions, func(i int, hdr, meta []byte) error {
		ver := &x.versions[i]
		_, err = ver.header.unmarshalV(headerV, hdr)
		if err != nil {
			return err
		}
		ver.meta = meta

		// Fix inconsistent x-minio-internal-replication-timestamp by loading and reindexing.
		if metaV < 2 && ver.header.Type == DeleteType {
			// load (and convert) version.
			version, err := x.getIdx(i)
			if err == nil {

		if err == errNoSuchUser || err == errNoSuchGroup {
			if globalIAMSys.LDAPConfig.Enabled() {
				// When LDAP is enabled, warn user that they are using the wrong
				// API. FIXME: error can be no such group as well - fix errNoSuchUserLDAPWarn
				writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, errNoSuchUserLDAPWarn), r.URL)
				return
			}
		}
		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
		return
	}