possible that after redirection the browser may land on a different MinIO server. For example, the domain `console.minio.example.org` may resolve to `console-X.minio.example.org`, where `X` is `1`, `2`, `3` or `4`. For the login to work, if the user first landed on `console-1.minio.example.org`, they must be redirected back to the same place after logging in at the OpenID provider's web-page. To ensure this, set the `MINIO_IDENTITY_OPENID_REDIRECT_URI_DYNAMIC=on` parameter - this lets MinIO set the redirect...

### Errors

XML error response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_Errors)

## Sample `POST` Request

```

    public void testReadParameterWordsWireFormat() {
        // Prepare a buffer with sample data.
        // 2 bytes for fileAttributes, 4 bytes for lastWriteTime, 4 bytes for fileSize
        byte[] buffer = new byte[20];
        // File Attributes: 0x0010 (Directory)
        buffer[0] = 0x10;
        buffer[1] = 0x00;
        // Last Write Time (UTime): A sample timestamp in milliseconds

## Sample `POST` Request

```
http://minio:9000/?Action=AssumeRole&DurationSeconds=3600&Version=2011-06-15&Policy={"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::*"}]}&AUTHPARAMS
```

## Sample Response

```
<?xml version="1.0" encoding="UTF-8"?>

            Trans2QueryPathInformationResponse resp =
                    new Trans2QueryPathInformationResponse(Trans2QueryPathInformationResponse.SMB_QUERY_FILE_BASIC_INFO);

            // Create a buffer with sample data
            byte[] buffer = new byte[100];
            // Fill with some test data
            for (int i = 0; i < buffer.length; i++) {
                buffer[i] = (byte) (i % 256);
            }

For example:
```shell
group_search_filter: (&(objectClass=group)(member:1.2.840.113556.1.4.1941:=%d))
user_dn_search_filter: (&(memberOf:1.2.840.113556.1.4.1941:=CN=group,DC=dc,DC=net)(sAMAccountName=%s))
```

### Sample settings

Here are some (minimal) sample settings for development or experimentation:

```shell

        // Test successful reading of 6 bytes from the input stream.
        // The content of these bytes is not critical for this test, only that 6 bytes are read.
        byte[] data = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06 }; // Sample 6 bytes
        ByteArrayInputStream bais = new ByteArrayInputStream(data);
        SessionRetargetResponsePacket packet = new SessionRetargetResponsePacket();

        // Create a buffer large enough to hold the read bytes

        private final int dataCompactionMode = 1;
        private final int dataLength = 1024;
        private final int dataOffset = 54;

        @BeforeEach
        public void setUp() {
            // Build a sample buffer
            int bufferIndex = 0;
            bufferIndex += 2; // reserved
            writeInt2(dataCompactionMode, buffer, bufferIndex);
            bufferIndex += 2;
            bufferIndex += 2; // reserved

    for (char base : zeros.toCharArray()) {
      for (int offset = 0; offset < 10; offset++) {
        sb.append((char) (base + offset));
      }
    }
    ALL_DIGITS = sb.toString();
  }

  /** Sample CharMatcher instances for benchmarking. */
  public enum SampleMatcherConfig {
    WHITESPACE(CharMatcher.whitespace(), WHITESPACE_CHARACTERS),
    HASH(CharMatcher.is('#'), "#"),
    ASCII(CharMatcher.ascii(), ASCII_CHARACTERS),

Once successfully set restart the MinIO instance.

```
mc admin service restart myminio
```

### Using WebIdentiy API

On another terminal run `web-identity.go` a sample client application which obtains JWT id_tokens from an identity provider, in our case its Keycloak. Uses the returned id_token response to get new temporary credentials from the MinIO server using the STS API call `AssumeRoleWithWebIdentity`.