LoginContext lc = new LoginContext(loginContextName);
        lc.login();
        this.subject = lc.getSubject();
    }


    public KerberosKey[] getKeys () {
        List<Key> serverKeys = new ArrayList<>();

        Set<Object> serverPrivateCredentials = this.subject.getPrivateCredentials();
        for ( Object credential : serverPrivateCredentials )
            if ( credential instanceof KerberosKey )

      }

    fun build(): HeldCertificate {
      // Subject keys & identity.
      val subjectKeyPair = keyPair ?: generateKeyPair()
      val subjectPublicKeyInfo =
        CertificateAdapters.subjectPublicKeyInfo.fromDer(
          subjectKeyPair.public.encoded.toByteString(),
        )
      val subject: List<List<AttributeTypeAndValue>> = subject()

  // APIGroup holds the API group of the referenced subject.
  // Defaults to "" for ServiceAccount subjects.
  // Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
  // +optional
  optional string apiGroup = 2;

  // Name of the object being referenced.
  optional string name = 3;

  // Defaults to "v1" for ServiceAccount subjects.
  // Defaults to "rbac.authorization.k8s.io/v1alpha1" for User and Group subjects.
  // +k8s:conversion-gen=false
  // +optional
  optional string apiVersion = 2;

  // Name of the object being referenced.
  optional string name = 3;

	defer s.Shutdown()

	clientConfig := &NATSArgs{
		Enable: true,
		Address: xnet.Host{
			Name:      "localhost",
			Port:      (xnet.Port(opts.Port)),
			IsPortSet: true,
		},
		Subject: "test",
	}
	con, err := clientConfig.connectNats()
	if err != nil {
		t.Errorf("Could not connect to nats: %v", err)
	}
	defer con.Close()
}

func TestNatsConnUserPass(t *testing.T) {

  // `type` indicates whether this priority level is subject to
  // limitation on request execution.  A value of `"Exempt"` means
  // that requests of this priority level are not subject to a limit
  // (and thus are never queued) and do not detract from the
  // capacity made available to other priority levels.  A value of
  // `"Limited"` means that (a) requests of this priority level
  // _are_ subject to limits and (b) some of the server's limited

		if target.args.Streaming.Async {
			_, err = target.stanConn.PublishAsync(target.args.Subject, data, nil)
		} else {
			err = target.stanConn.Publish(target.args.Subject, data)
		}
	} else {
		if target.jstream != nil {
			_, err = target.jstream.Publish(target.args.Subject, data)
		} else {
			err = target.natsConn.Publish(target.args.Subject, data)
		}
	}
	return err
}

  val signatureValue: BitString,
) {
  val commonName: Any?
    get() {
      return tbsCertificate.subject
        .flatten()
        .firstOrNull { it.type == ObjectIdentifiers.COMMON_NAME }
        ?.value
    }

  val organizationalUnitName: Any?
    get() {
      return tbsCertificate.subject
        .flatten()
        .firstOrNull { it.type == ObjectIdentifiers.ORGANIZATIONAL_UNIT_NAME }
        ?.value

  // APIGroup holds the API group of the referenced subject.
  // Defaults to "" for ServiceAccount subjects.
  // Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
  // +optional
  optional string apiGroup = 2;

  // Name of the object being referenced.
  optional string name = 3;

In case of certificate-based authentication, MinIO has to map the client-provided certificate to an S3 policy. MinIO does this via the subject common name field of the X.509 certificate. So, MinIO will associate a certificate with a subject `CN = foobar` to a S3 policy named `foobar`.

The following self-signed certificate is issued for `consoleAdmin`. So, MinIO would associate it with the pre-defined `consoleAdmin` policy.