if (domains == null) {
            return false;
        }
        domain = domain.toLowerCase();
        return domains.get(domain) != null;
    }

    /**
     * Gets a domain controller transport for the specified domain
     * @param domain the domain name
     * @param auth the authentication credentials
     * @return an SMB transport to the domain controller

            }
            rpc.domains = new lsarpc.LsarRefDomainList();
            rpc.domains.count = 1;
            rpc.domains.max_count = 1;
            rpc.domains.domains = new lsarpc.LsarTrustInformation[1];
            rpc.domains.domains[0] = new lsarpc.LsarTrustInformation();
            rpc.domains.domains[0].name = new UnicodeString("", false);
            rpc.domains.domains[0].sid = new jcifs.dcerpc.rpc.sid_t();

        public LsarTrustInformation[] domains;
        /** Maximum count of domains. */
        public int max_count;

        @Override
        public void encode(NdrBuffer _dst) throws NdrException {
            _dst.align(4);
            _dst.enc_ndr_long(this.count);
            _dst.enc_ndr_referent(this.domains, 1);
            _dst.enc_ndr_long(this.max_count);

            if (this.domains != null) {

        synchronized (this.domainsLock) {
            final Map<String, Map<String, CacheEntry<DfsReferralDataInternal>>> domains = getTrustedDomains(tf);
            if (domains == null) {
                return false;
            }
            domain = domain.toLowerCase(Locale.ROOT);
            return domains.get(domain) != null;
        }
    }

        public LsarTrustInformation[] domains;
        /** Maximum count of domains. */
        public int max_count;

        @Override
        public void encode(NdrBuffer _dst) throws NdrException {
            _dst.align(4);
            _dst.enc_ndr_long(count);
            _dst.enc_ndr_referent(domains, 1);
            _dst.enc_ndr_long(max_count);

            if (domains != null) {

				},
			},
			domains:          []string{"mys3.bucket.org"},
			bucket:           "mybucket",
			object:           "test/1.txt",
			expectedLocation: "https://mybucket.mys3.bucket.org/test/1.txt",
		},
	}
	for _, testCase := range testCases {
		t.Run("", func(t *testing.T) {
			gotLocation := getObjectLocation(testCase.request, testCase.domains, testCase.bucket, testCase.object)

* **TCP doesn't know about "domains"**. Only about IP addresses.
    * The information about the **specific domain** requested goes in the **HTTP data**.
* The **HTTPS certificates** "certify" a **certain domain**, but the protocol and encryption happen at the TCP level, **before knowing** which domain is being dealt with.

        assertNotNull(refDomainList.domains);
        assertEquals(2, refDomainList.domains.length);
        assertNotNull(refDomainList.domains[0]);
        assertNotNull(refDomainList.domains[1]);
        // Cannot verify decode on non-mock objects - they are created by decode
        // Just verify they were created
        assertNotNull(refDomainList.domains[0]);
        assertNotNull(refDomainList.domains[1]);
    }

    }

    @ParameterizedTest
    @MethodSource("domains")
    @DisplayName("getUserDomain handles null and empty")
    void getUserDomain_edges(String domain) {
        TestCredentials creds = new TestCredentials(domain, false, false, new Subject(), false);
        assertEquals(domain, creds.getUserDomain());
    }

    static Stream<String> domains() {
        return Stream.of(null, "", "SALES");
    }

For a [distributed MinIO setup](https://docs.min.io/community/minio-object-store/operations/deployments/kubernetes.html), where there are multiple pods with different domain names expected to run, you will either need wildcard certificates valid for all the domains or have specific certificates for each domain. If you are going to use specific certificates, make sure to create Kubernetes secrets accordingly.