int length = Math.min(key.length, BLOCK_LENGTH);
        for (int i = 0; i < length; i++) {
            ipad[i] = (byte) (key[i] ^ IPAD);
            opad[i] = (byte) (key[i] ^ OPAD);
        }
        for (int i = length; i < BLOCK_LENGTH; i++) {
            ipad[i] = IPAD;
            opad[i] = OPAD;
        }
        try {
            md5 = MessageDigest.getInstance("MD5");
        } catch (Exception ex) {

        for ( int i = 0; i < length; i++ ) {
            this.ipad[ i ] = (byte) ( key[ i ] ^ IPAD );
            this.opad[ i ] = (byte) ( key[ i ] ^ OPAD );
        }
        for ( int i = length; i < BLOCK_LENGTH; i++ ) {
            this.ipad[ i ] = IPAD;
            this.opad[ i ] = OPAD;
        }

        this.md5 = Crypto.getMD5();
        engineReset();
    }

# OPA Quickstart Guide [![Slack](https://slack.minio.io/slack?type=svg)](https://slack.minio.io)

OPA is a lightweight general-purpose policy engine that can be co-located with MinIO server, in this document we talk about how to use OPA HTTP API to authorize requests. It can be used with any type of credentials (STS based like OpenID or LDAP, regular IAM users or service accounts).

OPA is enabled through MinIO's Access Management Plugin feature.

## Get started

		*a = oa
		return nil
	}

	*a = oa
	return nil
}

// Opa - implements opa policy agent calls.
type Opa struct {
	args   Args
	client *http.Client
}

// Enabled returns if opa is enabled.
func Enabled(kvs config.KVS) bool {
	return kvs.Get(URL) != ""
}

// LookupConfig lookup Opa from config, override with any ENVs.

	Compression compress.Config `json:"compress"`

	// OpenID configuration
	OpenID openid.Config `json:"openid"`

	// External policy enforcements.
	Policy struct {
		// OPA configuration.
		OPA opa.Args `json:"opa"`

		// Add new external policy enforcements here.
	} `json:"policy"`

	LDAPServerConfig xldap.LegacyConfig `json:"ldapserverconfig"`

                pad = parameterOffset % PADDING_SIZE;
                pad = pad == 0 ? 0 : PADDING_SIZE - pad;
                parameterOffset += pad;
            }

            // caclulate parameterDisplacement before calculating new parameterCount
            parameterDisplacement += parameterCount;

            int available = maxBufferSize - parameterOffset - pad;

    int writeParameterWordsWireFormat( byte[] dst, int dstIndex ) {
        int start = dstIndex;

        dataOffset = (dstIndex - headerStart) + 26; // 26 = off from here to pad

pad = ( dataOffset - headerStart ) % 4;
pad = pad == 0 ? 0 : 4 - pad;
dataOffset += pad;

        writeInt2( fid, dst, dstIndex );
        dstIndex += 2;
        writeInt4( offset, dst, dstIndex );
        dstIndex += 4;

		cfg.Compression.MimeTypes = strings.Split(compress.DefaultMimeTypes, config.ValueSeparator)
	case "30":
		// V30 -> V31
		cfg.OpenID = openid.Config{}
		cfg.Policy.OPA = opa.Args{
			URL:       &xnet.URL{},
			AuthToken: "",
		}
	case "31":
		// V31 -> V32
		cfg.Notify.NSQ = make(map[string]target.NSQArgs)
		cfg.Notify.NSQ["1"] = target.NSQArgs{}
	}

        }

        return bufferIndex - start;
    }
    int readBytesWireFormat( byte[] buffer, int bufferIndex ) {
        pad = pad1 = 0;
        int n;

        if( parameterCount > 0 ) {
            bufferIndex += pad = parameterOffset - ( bufferIndex - headerStart );
            System.arraycopy( buffer, bufferIndex, txn_buf,

	if err != nil {
		return false, err
	}

	// Handle large OPA responses when OPA URL is of
	// form http://localhost:8181/v1/data/httpapi/authz
	type opaResultAllow struct {
		Result struct {
			Allow bool `json:"allow"`
		} `json:"result"`
	}

	// Handle simpler OPA responses when OPA URL is of
	// form http://localhost:8181/v1/data/httpapi/authz/allow
	type opaResult struct {