policy":"inherited-policy","sub":"Cit1aWQ9ZGlsbG9uLG91"},"sessionPolicy":null,"status":"on","name":"","description":"","expiration":"1970-01-01T00:00:00Z"},"dillon-svcacct-1":{"parent":"oCnAoSQFtdVQtKwrB73j","accessKey":"dillon-svcacct-1","secretKey":"dillon-svcacct-1","groups":null,"claims":{"accessKey":"dillon-svcacct-1","parent":"oCnAoSQFtdVQtKwrB73j","sa-policy":"embedded-policy","sessionPolicy":"eyJWZXJzaW9uIjoiIiwi==","sessionPolicy-extracted":"{\"Version\":\"\",\"Statement\":null}"},"sess...

		if ucred.ParentUser == globalActiveCred.AccessKey && !globalAPIConfig.permitRootAccess() {
			return nil, nil, false, errAccessKeyDisabled
		}

		// Now check if we have a sessionPolicy.
		if _, ok = eclaims[policy.SessionPolicyName]; ok {
			owner = false
		} else {
			owner = globalActiveCred.AccessKey == ucred.ParentUser
		}

		groups = ucred.Groups
	}

		return auth.Credentials{}, time.Time{}, auth.ErrNoAccessKeyWithSecretKey
	}

	var policyBuf []byte
	if opts.sessionPolicy != nil {
		err := opts.sessionPolicy.Validate()
		if err != nil {
			return auth.Credentials{}, time.Time{}, err
		}
		policyBuf, err = json.Marshal(opts.sessionPolicy)
		if err != nil {
			return auth.Credentials{}, time.Time{}, err
		}
		if len(policyBuf) > maxSVCSessionPolicySize {

		m.Set(iamPolicyClaimNameSA(), inheritedPolicyType)
	}

	if opts.sessionPolicy != nil { // session policies is being updated
		if err := opts.sessionPolicy.Validate(); err != nil {
			return updatedAt, err
		}

		if opts.sessionPolicy.Version != "" && len(opts.sessionPolicy.Statements) > 0 {
			policyBuf, err := json.Marshal(opts.sessionPolicy)
			if err != nil {
				return updatedAt, err
			}

		return nil
	}

	sessionPolicy, err := policy.ParseConfig(bytes.NewReader([]byte(sessionPolicyStr)))
	if err != nil {
		return err
	}

	// Version in policy must not be empty
	if sessionPolicy.Version == "" {
		return errors.New("Version cannot be empty expecting '2012-10-17'")
	}

	policyBuf, err := json.Marshal(sessionPolicy)
	if err != nil {
		return err
	}

					SecretKey:     newCred.SecretKey,
					Groups:        newCred.Groups,
					Name:          newCred.Name,
					Description:   newCred.Description,
					Claims:        opts.claims,
					SessionPolicy: madmin.SRSessionPolicy(createReq.Policy),
					Status:        auth.AccountOn,
					Expiration:    createReq.Expiration,
				},
			},
			UpdatedAt: updatedAt,
		}))
	}
}

		return errSRInvalidRequest(errInvalidArgument)
	}
	switch {
	case change.Create != nil:
		var sp *policy.Policy
		var err error
		if len(change.Create.SessionPolicy) > 0 {
			sp, err = policy.ParseConfig(bytes.NewReader(change.Create.SessionPolicy))
			if err != nil {
				return wrapSRErr(err)
			}
		}
		// skip overwrite of local update if peer sent stale info