}
	if !sa.Credentials.IsServiceAccount() {
		return UserIdentity{}, nil, errNoSuchServiceAccount
	}

	var embeddedPolicy *policy.Policy

	pt, ptok := jwtClaims.Lookup(iamPolicyClaimNameSA())
	sp, spok := jwtClaims.Lookup(policy.SessionPolicyName)
	if ptok && spok && pt == embeddedPolicyType {
		policyBytes, err := base64.StdEncoding.DecodeString(sp)
		if err != nil {
			return UserIdentity{}, nil, err

			}
		}
	}
}

func lookupStyle(s string) minio.BucketLookupType {
	var lookup minio.BucketLookupType
	switch s {
	case "on":
		lookup = minio.BucketLookupPath
	case "off":
		lookup = minio.BucketLookupDNS
	default:
		lookup = minio.BucketLookupAuto
	}
	return lookup
}

// BatchJobPrefix - to support prefix field yaml unmarshalling with string or slice of strings

			continue
		}

		subClaimValue := cred.ParentUser
		if v, ok := claims.Lookup(subClaim); ok {
			subClaimValue = v
		}
		if v, ok := claims.Lookup(ldapActualUser); ok {
			subClaimValue = v
		}

		roleArn := openid.DummyRoleARN.String()
		s, ok := claims.Lookup(roleArnClaim)
		if ok {
			roleArn = s
		}
		v, ok := res[cred.ParentUser]
		if ok {

	if isAllBucketsNotFound(errs) {
		writeErrorResponse(ctx, w, toAPIError(ctx, errs[0]), r.URL)
		return
	}

	for i := range errs {
		// DeleteMarkerVersionID is not used specifically to avoid
		// lookup errors, since DeleteMarkerVersionID is only
		// created during DeleteMarker creation when client didn't
		// specify a versionID.
		objToDel := ObjectToDelete{
			ObjectV: ObjectV{

	rv, err = tgtClient.PutWithMeta(ctx, destObj, pr, fi.Size, map[string]string{
		"name": object, // preserve the original name of the object on the remote tier object metadata.
		// this is just for future reverse lookup() purposes (applies only for new objects)
		// does not apply retro-actively on already transitioned objects.
	})
	pr.CloseWithError(err)
	if err != nil {
		traceFn(ILMTransition, nil, err)
		return err