return providerPrefix // this is true for certificate and custom providers
		}
		return madmin.OpenIDProvider // openid users are already hashed, so no separator
	}

	return madmin.BuiltinProvider // default to internal
}

// getProviderInfoFromClaims - returns the provider info from the claims.
func populateProviderInfoFromClaims(claims map[string]any, provider string, resp *madmin.InfoAccessKeyResp) {
	resp.UserProvider = provider

        // Try providers in order of preference
        List<RdmaProvider> providers = Arrays.asList(new DisniRdmaProvider(), // InfiniBand/RoCE - highest performance
                new TcpRdmaProvider() // TCP fallback - always available
        );

        for (RdmaProvider provider : providers) {
            if (provider.isAvailable()) {
                log.info("Selected RDMA provider: {}", provider.getProviderName());

**NOTE**: When configuring multiple OpenID based authentication providers on a MinIO cluster, any number of Role Policy based providers may be configured, and at most one JWT Claim based provider may be configured.

<details><summary>Example 1: Two role policy providers</summary>

Sample environment variables:

```
MINIO_IDENTITY_OPENID_DISPLAY_NAME="my first openid"

/**
 * Returns a new provider that takes its value from at most one
 * of the given providers. If no input provider is present, the output
 * provider will not be present. If more than one input provider
 * has a value specified, the resulting provider will throw an
 * exception when queried.
 */
fun <T: Any> atMostOneOf(vararg providers: Provider<T>): Provider<T> {
    return providers.map { provider ->

                        InetSocketAddress address,
                        RdmaProvider provider) throws IOException {
        super(context, address.getAddress(), address.getPort());
        
        this.provider = provider;
        this.rdmaConnection = provider.createConnection(address, getLocalAddress());
        this.bufferManager = new RdmaBufferManager(provider);
        this.credits = new RdmaCredits();
        

                "Method com.example.TaskInterface.getIsFailOnError(): Is not annotated with @since 2.0. Reason for accepting this: Upgraded property" to listOf("Method now provides default implementation"),
                // see https://github.com/siom79/japicmp/issues/289

    /**
     * Get provider name (e.g., "InfiniBand", "iWARP", "RoCE", "TCP Fallback")
     *
     * @return human-readable provider name
     */
    String getProviderName();

    /**
     * Get maximum message size supported by this provider
     *
     * @return maximum message size in bytes
     */
    int getMaxMessageSize();

    /**

    public void testCreateProviderAuto() {
        RdmaProvider provider = RdmaProviderFactory.createProvider("auto");
        assertNotNull(provider, "Auto provider selection should return a provider");
        assertTrue(provider.isAvailable(), "Returned provider should be available");
    }

    @Test
    public void testCreateProviderTcp() {
        RdmaProvider provider = RdmaProviderFactory.createProvider("tcp");

        }
    }.toMap()

/**
 * Creates a [Provider] that returns `true` when this [Provider] has a value
 * and `false` otherwise. The returned [Provider] always has a value.
 * @see Provider.isPresent
 */
private
fun <T : Any> Provider<T>.presence(): Provider<Boolean> =
    map { true }.orElse(false)


fun Project.gradleProperty(propertyName: String) = providers.gradleProperty(propertyName)

	if ok {
		user, err := pCfg.provider.LookupUser(userid)
		if err != nil && err != provider.ErrAccessTokenExpired {
			return user, err
		}
		if err == provider.ErrAccessTokenExpired {
			if err = pCfg.provider.LoginWithClientID(pCfg.ClientID, pCfg.ClientSecret); err != nil {
				return user, err
			}
			user, err = pCfg.provider.LookupUser(userid)
		}
		return user, err
	}