NewHTTPTransport(), xhttp.DrainBody, globalSite.Region)
	if err != nil {
		iamLogIf(ctx, fmt.Errorf("Unable to initialize OpenID: %w", err), logger.WarningKind)
	}

	// Initialize if LDAP is enabled
	ldapConfig, err := xldap.Lookup(s, globalRootCAs)
	if err != nil {
		iamLogIf(ctx, fmt.Errorf("Unable to load LDAP configuration (LDAP configuration will be disabled!): %w", err), logger.WarningKind)
	}

	}

	bootstrapTraceMsg("purging expired STS credentials")

	iamListing, ok := iamOS.cachedIAMListing.Load().(map[string][]string)
	if !ok {
		// There has been no store yet. This should never happen!
		iamLogIf(GlobalContext, errors.New("WARNING: no cached IAM listing found"))
		return nil
	}

	// Scan STS users on disk and purge expired ones. We do not need to hold a
	// lock with store.lock() here.

	logger.LogIf(ctx, "replication", err, errKind...)
}

func replLogOnceIf(ctx context.Context, err error, id string, errKind ...interface{}) {
	logger.LogOnceIf(ctx, "replication", err, id, errKind...)
}

func iamLogIf(ctx context.Context, err error, errKind ...interface{}) {
	logger.LogIf(ctx, "iam", err, errKind...)
}

func rebalanceLogIf(ctx context.Context, err error, errKind ...interface{}) {

					if !ok {
						time.Sleep(1 * time.Second)
						// Upon an error on watch channel
						// re-init the watch channel.
						goto outerLoop
					}
					if err := watchResp.Err(); err != nil {
						iamLogIf(ctx, err)
						// log and retry.
						time.Sleep(1 * time.Second)
						// Upon an error on watch channel
						// re-init the watch channel.
						goto outerLoop
					}

				iamLogIf(ctx, err)
			} else if foundGroupDN == "" || !underBaseDN {
				err = errNoSuchGroup
			}
			entityName = foundGroupDN
		} else {
			var foundUserDN string
			if foundUserDN, err = globalIAMSys.LDAPConfig.GetValidatedDNForUsername(entityName); err != nil {
				iamLogIf(ctx, err)
			} else if foundUserDN == "" {
				err = errNoSuchUser

			store.deleteMappedPolicy(ctx, user, userType, false)
			cache.iamUserPolicyMap.Delete(user)

			// we are only logging errors, not handling them.
			err := store.deleteUserIdentity(ctx, user, userType)
			iamLogIf(GlobalContext, err)
			delete(cache.iamUsersMap, user)

			deleted = true
		}
	}

	if deleted {
		cache.updatedAt = time.Now()
	}

	return nil
}

				iamLogIf(ctx, err)
			} else if foundGroupDN == "" || !underBaseDN {
				err = errNoSuchGroup
			}
			entityName = foundGroupDN
		} else {
			var foundUserDN string
			if foundUserDN, err = globalIAMSys.LDAPConfig.GetValidatedDNForUsername(entityName); err != nil {
				iamLogIf(ctx, err)
			} else if foundUserDN == "" {
				err = errNoSuchUser