EnvTestOpenIDServer2 = "_MINIO_OPENID_TEST_SERVER_2"
)

// SetUpOpenIDs - sets up one or more OpenID test servers using the test OpenID
// container and canned data from https://github.com/minio/minio-ldap-testing
//
// Each set of client app params corresponds to a separate openid server, and
// the i-th server in this will be applied the i-th policy in `rolePolicies`. If

// license that can be found in the LICENSE file.

//go:build unix

package unix

const (
	R_OK = 0x4
	W_OK = 0x2
	X_OK = 0x1

	// NoFollowErrno is the error returned from open/openat called with
	// O_NOFOLLOW flag, when the trailing component (basename) of the path
	// is a symbolic link.
	NoFollowErrno = noFollowErrno

//   - android: see linux
//   - darwin: https://github.com/apple/darwin-xnu/blob/main/bsd/man/man2/open.2
//   - hurd: who knows if it works at all (https://www.gnu.org/software/hurd/open_issues/open_symlink.html)
//   - illumos: https://illumos.org/man/2/open
//   - ios: see darwin
//   - linux: https://man7.org/linux/man-pages/man2/openat.2.html

    ]),
    row.new('Network')
    + row.withPanels([
      panels.timeSeries.connections('Connections', queries.connections, 'Connections opened and closed per instance'),
      panels.timeSeries.bytesRate('Bytes Transmitted', queries.bytes, 'Bytes sent and recieved per instance'),
      panels.timeSeries.dns('DNS Request', queries.dns, 'DNS queries recieved per instance'),

		writeSTSErrorResponse(ctx, w, ErrSTSInternalError, err)
		return
	}

	// https://openid.net/specs/openid-connect-core-1_0.html#ClaimStability
	// claim is only considered stable when subject and iss are used together
	// this is to ensure that ParentUser doesn't change and we get to use
	// parentUser as per the requirements for service accounts for OpenID
	// based logins.
	var subFromToken string
	if v, ok := claims[subClaim]; ok {

          |||
            sum by (pod) (
              go_goroutines{%(appLabels)s}
            )
          |||
        ),

      connections:
        [
          self.query(
            'Opened ({{pod}})',
            |||
              sum by (pod) (
                rate(
                  istio_tcp_connections_opened_total{%(podLabels)s}
                [$__rate_interval])
              )

         "type": "row"
      },
      {
         "datasource": {
            "type": "datasource",
            "uid": "-- Mixed --"
         },
         "description": "Connections opened and closed per instance",
         "fieldConfig": {
            "defaults": {
               "custom": {
                  "fillOpacity": 10,
                  "gradientMode": "hue",

	TotalRefreshFailures            uint64

	sync.Mutex

	iamRefreshInterval time.Duration

	LDAPConfig   xldap.Config  // only valid if usersSysType is LDAPUsers
	OpenIDConfig openid.Config // only valid if OpenID is configured
	STSTLSConfig xtls.Config   // only valid if STS TLS is configured

	usersSysType UsersSysType

	rolesMap map[arn.ARN]string

	// Persistence layer for IAM subsystem

// we are going to (try to) remove the file.
// The contents of this file are not relevant for test caching.
func openDirAt(dirfd int, name string) (*File, error) {
	var r int
	for {
		var e error
		r, e = unix.Openat(dirfd, name, O_RDONLY|syscall.O_CLOEXEC|syscall.O_DIRECTORY|syscall.O_NOFOLLOW, 0)
		if e == nil {
			break
		}

		// See comment in openFileNolog.
		if e == syscall.EINTR {
			continue
		}

data:
  config.yaml: |
    additional_display_details:
    - annotation: kiali.io/api-spec
      icon_annotation: kiali.io/api-type
      title: API Documentation
    auth:
      openid: {}
      openshift:
        client_id_prefix: kiali
      strategy: anonymous
    clustering:
      autodetect_secrets:
        enabled: true
        label: kiali.io/multiCluster=true
      clusters: []