byte[] derived1 = keyManager.deriveKey(baseKey, "label1", null, 32);
        byte[] derived2 = keyManager.deriveKey(baseKey, "label2", null, 32);
        byte[] derived3 = keyManager.deriveKey(baseKey, "label1", new byte[] { 1, 2, 3 }, 32);

        assertEquals(32, derived1.length, "Derived key should have correct length");
        assertEquals(32, derived2.length, "Derived key should have correct length");

    }

    /**
     * Derive a new key from an existing key
     *
     * @param baseKey the base key
     * @param label key derivation label
     * @param context key derivation context
     * @param length desired key length in bytes
     * @return derived key
     * @throws GeneralSecurityException if key derivation fails
     */

	currTime := UTCNow()

	var (
		username = cred.AccessKey
		claims   = cred.Claims
		groups   = cred.Groups
	)

	if cred.IsTemp() || cred.IsServiceAccount() {
		// For derived credentials, check the parent user's permissions.
		username = cred.ParentUser
	}

	principalType := "Anonymous"
	if username != "" {
		principalType = "User"
		if len(claims) > 0 {

// OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
// SUCH DAMAGE.
//

package jcifs.smb1.util;

/**
 * This code is derived from the above source
 * JCIFS API
 * Norbert Hranitzky
 *
 * <p>and modified again by Michael B. Allen
 */

public class DES {

    private final int[] encryptKeys = new int[32];

	userExists := false
	var tempAccounts []UserIdentity
	for _, v := range cache.iamUsersMap {
		isDerived := false
		if v.Credentials.IsServiceAccount() || v.Credentials.IsTemp() {
			isDerived = true
		}

		if !isDerived && v.Credentials.AccessKey == accessKey {
			userExists = true
		} else if isDerived && v.Credentials.ParentUser == accessKey {
			userExists = true
			if v.Credentials.IsTemp() {

     * @return whether to allow creating compound requests with that command
     */
    boolean isAllowCompound(String command);

    /**
     * Machine identifier
     *
     * ClientGuid, ... are derived from this value.
     *
     * Normally this should be randomly assigned for each client instance/configuration.
     *
     * @return machine identifier (32 byte)
     */
    byte[] getMachineId();

	isSvcAccForRequestor := targetUser == requestorUser || targetUser == requestorParentUser

	// If we are creating svc account for request sender, ensure
	// that targetUser is a real user (i.e. not derived
	// credentials).
	if isSvcAccForRequestor {
		if requestorIsDerivedCredential {
			if requestorParentUser == "" {
				writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx,

// AssumeRoleWithCertificate case, the "virtual" parent user is the value of the
// `Subject.CommonName` field. For the OIDC (without RoleARN) case the "virtual"
// parent is derived as a concatenation of the `sub` and `iss` fields. The
// policies applicable to the STS credential are associated with this "virtual"
// parent.
//
// When a policyName is given to this function, the policy association is

	"github.com/minio/pkg/v3/mimedb"
	ftp "goftp.io/server/v2"
)

var _ ftp.Driver = &ftpDriver{}

// ftpDriver implements ftpDriver to store files in minio
type ftpDriver struct {
	endpoint string
}

// NewFTPDriver implements ftp.Driver interface
func NewFTPDriver() ftp.Driver {
	return &ftpDriver{endpoint: fmt.Sprintf("127.0.0.1:%s", globalMinioPort)}
}

            "Waiting for a process to open the other end of the pipe.", "Access is denied.", "A duplicate name exists on the network.",
            "The specified network name is no longer available.", "Network access is denied.", "The network name cannot be found.",