// 1. Check that svc account appears in listing
	c.assertSvcAccAppearsInListing(ctx, userAdmClient, accessKey, cr.AccessKey)

	// 2. Check that svc account info can be queried
	c.assertSvcAccInfoQueryable(ctx, userAdmClient, accessKey, cr.AccessKey, false)

	// 3. Check S3 access
	c.assertSvcAccS3Access(ctx, s, cr, bucket)

	// 5. Check that service account can be deleted.

		// For STS policy map, we need to merge the new cache with the existing
		// cache because the periodic IAM reload is partial. The periodic load
		// here is to account for STS policy mapping changes that should apply
		// for service accounts derived from such STS accounts (i.e. LDAP STS
		// accounts).
		newCache.iamSTSPolicyMap.Range(func(k string, v MappedPolicy) bool {
			cache.iamSTSPolicyMap.Store(k, v)
			return true
		})

	// As the session policy exists, even if the parent is the root account, it
	// must be restricted by it. So, we set `.IsOwner` to false here
	// unconditionally.
	//
	// We also set `DenyOnly` arg to false here - this is an IMPORTANT corner
	// case: DenyOnly is used only for allowing an account to do actions related
	// to its own account (like create service accounts for itself, among

		return
	}

	// Permission checks:
	//
	// 1. Any type of account (i.e. access keys (previously/still called service
	// accounts), STS accounts, internal IDP accounts, etc) with the
	// policy.UpdateServiceAccountAdminAction permission can update any service
	// account.
	//
	// 2. We would like to let a user update their own access keys, however it

	if accessKey == "" {
		return np, grid.NewRemoteErr(errors.New("service account name is missing"))
	}

	if err := globalIAMSys.DeleteServiceAccount(context.Background(), accessKey, false); err != nil {
		return np, grid.NewRemoteErr(err)
	}

	return np, nerr
}

// LoadServiceAccountHandler - reloads a service account on the server.

labels.searchlog_log_type_search_keyword=Keyword Count
labels.searchlog_log_type_search_zerohit=Zero Hit Count
labels.searchlog_log_type_search_zeroclick=Zero Click Count
labels.searchlog_log_type_search_count_hour=Search Count/Hour
labels.searchlog_log_type_search_count_day=Search Count/Day
labels.searchlog_log_type_search_user_hour=User Count/Hour
labels.searchlog_log_type_search_user_day=User Count/Day

	},
	ErrAccountNotEligible: {
		Code:           "XMinioInvalidIAMCredentials",
		Description:    "The account key is not eligible for this operation",
		HTTPStatusCode: http.StatusForbidden,
	},
	ErrAdminServiceAccountNotFound: {
		Code:           "XMinioInvalidIAMCredentials",
		Description:    "The specified service account is not found",
		HTTPStatusCode: http.StatusNotFound,
	},
	ErrPostPolicyConditionInvalidFormat: {

labels.searchlog_log_type_search_keyword=Keyword Count
labels.searchlog_log_type_search_zerohit=Zero Hit Count
labels.searchlog_log_type_search_zeroclick=Zero Click Count
labels.searchlog_log_type_search_count_hour=Search Count/Hour
labels.searchlog_log_type_search_count_day=Search Count/Day
labels.searchlog_log_type_search_user_hour=User Count/Hour
labels.searchlog_log_type_search_user_day=User Count/Day

     *
     * @param ldapUser the LDAP user to retrieve roles for
     * @param bindDn the bind DN for LDAP connection
     * @param accountFilter the account filter pattern
     * @param groupFilter the group filter pattern
     * @param lazyLoading the lazy loading consumer for roles
     * @return an array of role names
     */

				"application/vnd.gmx",
				"application/vnd.google-earth.kml+xml",
				"application/vnd.google-earth.kmz",
				"application/vnd.grafeq",
				"application/vnd.gridmp",
				"application/vnd.groove-account",
				"application/vnd.groove-help",
				"application/vnd.groove-identity-message",
				"application/vnd.groove-injector",
				"application/vnd.groove-tool-message",
				"application/vnd.groove-tool-template",