// to retry with 503 errors when server is coming up.
			return auth.Credentials{}, false, ErrIAMNotInitialized
		}

		// Check if the access key is part of users credentials.
		u, ok, err := globalIAMSys.CheckKey(r.Context(), accessKey)
		if err != nil {
			return auth.Credentials{}, false, ErrIAMNotInitialized
		}
		if !ok {
			// Credentials could be valid but disabled - return a different
			// error in such a scenario.

				logErr := fmt.Errorf("failed to delete extraneous LDAP DN mapping for `%s`: %w", origKeys[0], delErr)
				iamLogIf(ctx, logErr)
			}
		}
	}
	return nil
}

// CheckKey validates the incoming accessKey
func (sys *IAMSys) CheckKey(ctx context.Context, accessKey string) (u UserIdentity, ok bool, err error) {
	if !sys.Initialized() {
		return u, false, nil
	}

	if accessKey == globalActiveCred.AccessKey {