// Indicates if server was started as `--address ":0"`
	globalDynamicAPIPort bool

	// Add new variable global values here.
)

var globalAuthPluginMutex sync.Mutex

func newGlobalAuthNPluginFn() *idplugin.AuthNPlugin {
	globalAuthPluginMutex.Lock()
	defer globalAuthPluginMutex.Unlock()
	return globalAuthNPlugin
}

func newGlobalAuthZPluginFn() *polplugin.AuthZPlugin {

	defer logger.AuditLog(ctx, w, r, claims, auditLogFilterKeys...)

	if !globalIAMSys.Initialized() {
		writeSTSErrorResponse(ctx, w, ErrSTSIAMNotInitialized, errIAMNotInitialized)
		return
	}

	authn := newGlobalAuthNPluginFn()
	if authn == nil {
		writeSTSErrorResponse(ctx, w, ErrSTSNotInitialized, errors.New("STS API 'AssumeRoleWithCustomToken' is disabled"))
		return
	}

	action := r.Form.Get(stsAction)

	// Initialize RoleARNs
	sys.rolesMap = make(map[arn.ARN]string)

	// From OpenID
	maps.Copy(sys.rolesMap, sys.OpenIDConfig.GetRoleInfo())

	// From AuthN plugin if enabled.
	if authn := newGlobalAuthNPluginFn(); authn != nil {
		maps.Copy(sys.rolesMap, authn.GetRoleInfo())
	}

	sys.printIAMRoles()
	sys.Unlock()

	retryCtx, cancel := context.WithCancel(ctx)