```sh
mc idp ldap policy attach myminio mypolicy --user='uid=james,cn=accounts,dc=myldapserver,dc=com'
```

```sh
mc idp ldap policy attach myminio mypolicy ----group='cn=projectx,ou=groups,ou=hwengg,dc=min,dc=io'
```

To remove a policy association, use the similar `detach` command:

```sh
mc idp ldap policy detach myminio mypolicy --user='uid=james,cn=accounts,dc=myldapserver,dc=com'
```

```sh

	NodeName = "testnode"

	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()

	pod := &corev1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "test",
			Namespace: "test",
			UID:       "1234",
		},
		Spec: corev1.PodSpec{
			NodeName: NodeName,
		},
		Status: corev1.PodStatus{
			PodIP: "11.1.1.12",
		},
	}
	ns := &corev1.Namespace{
		ObjectMeta: metav1.ObjectMeta{

  optional string resource = 3;

  // Name is the name of resource being referenced.
  optional string name = 4;

  // UID identifies exactly one incarnation of the resource.
  optional string uid = 5;
}

// ResourceClaimList is a collection of claims.
message ResourceClaimList {
  // Standard list metadata
  // +optional

    private Integer getUid(Object obj) {
      Integer uid = uids.get(obj);
      if (uid == null) {
        // One or more integer values could be skipped in the event of a race
        // to generate a UID for the same object from multiple threads, but
        // that shouldn't be a problem.
        uid = counter.getAndIncrement();
        Integer alreadySet = uids.putIfAbsent(obj, uid);
        if (alreadySet != null) {

  // Populated by the API server on creation and immutable.
  // +optional
  optional string username = 2;

  // uid contains the uid of the user that created the CertificateSigningRequest.
  // Populated by the API server on creation and immutable.
  // +optional
  optional string uid = 3;

  // groups contains group membership of the user that created the CertificateSigningRequest.

	hdr.Typeflag = v7.typeFlag()[0]
	hdr.Name = p.parseString(v7.name())
	hdr.Linkname = p.parseString(v7.linkName())
	hdr.Size = p.parseNumeric(v7.size())
	hdr.Mode = p.parseNumeric(v7.mode())
	hdr.Uid = int(p.parseNumeric(v7.uid()))
	hdr.Gid = int(p.parseNumeric(v7.gid()))
	hdr.ModTime = time.Unix(p.parseNumeric(v7.modTime()), 0)

	// Unpack format specific fields.
	if format > formatV7 {
		ustar := tr.blk.toUSTAR()

  // it needs a reflection here.
  // +optional
  map<string, ExtraValue> extra = 5;

  // UID information about the requesting user.
  // +optional
  optional string uid = 6;
}

// SubjectAccessReviewStatus
message SubjectAccessReviewStatus {
  // Allowed is required. True if the action would be allowed, false otherwise.

			"name":    "cat",
			"user_id": gorm.Expr("(?)", DB.Table("(?) as tmp", subQuery).Select("@uid:=id")),
		},
		{
			"name":    "dog",
			"user_id": gorm.Expr("@uid"),
		},
	})

	if !regexp.MustCompile(`INSERT INTO .pets. \(.name.,.user_id.\) .*VALUES \(.+,\(SELECT @uid:=id FROM \(SELECT id FROM .users. WHERE name=.+\) as tmp\)\),\(.+,@uid\)`).MatchString(result.Statement.SQL.String()) {

  // it needs a reflection here.
  // +optional
  map<string, ExtraValue> extra = 5;

  // UID information about the requesting user.
  // +optional
  optional string uid = 6;
}

// SubjectAccessReviewStatus
message SubjectAccessReviewStatus {
  // Allowed is required. True if the action would be allowed, false otherwise.

  // (succeeded or failed), the controller does three steps to account for it
  // in the job status:
  //
  // 1. Add the pod UID to the arrays in this field.
  // 2. Remove the pod finalizer.
  // 3. Remove the pod UID from the arrays while increasing the corresponding
  //     counter.
  //
  // Old jobs might not be tracked using this field, in which case the field
  // remains null.