- header:
                    name: :method
                    stringMatch:
                      exact: rule[0]-to[0]-method[0]
        principals:
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://td1/ns/rule[0]/sa/from[0]-principal[0]
                - authenticated:

    policies:
      ns[foo]-policy[httpbin]-rule[0]:
        permissions:
        - andRules:
            rules:
            - any: true
        principals:
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://td1/ns/rule[0]/sa/from[0]-principal[0]
                - authenticated:

// GetIDsFromProxyInfo is a helper function to retrieve list of IDs from Proxy.
func GetIDsFromProxyInfo(kubeClient kube.CLIClient, istioNamespace string) ([]string, error) {
	var IDs []string
	pi, err := GetProxyInfo(kubeClient, istioNamespace)
	if err != nil {
		return IDs, fmt.Errorf("failed to get proxy infos: %v", err)
	}
	for _, pi := range *pi {
		IDs = append(IDs, pi.ID)
	}
	return IDs, nil

  // b) IDs in range [0,kMaxResourceTypeId] represent resource type IDs; we use
  //    such IDs when we know the resource type but not the instance
  // c) IDs > kMaxResourceTypeId represent resource instance IDs (i.e., we know
  //    the specific resource instance)
  //
  // Note: In general, there can be different ops allocating a resource of the
  // same type, for one we might assign a resource type ID and for the other

            - any: true
        principals:
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .+
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:

            - any: true
        principals:
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .+
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:

    /**
     * Creates a new unique id.
     * <p>
     * New ids can only be created if no ids have been loaded from the configuration cache.
     * When re-creating an object due to loading from the configuration cache,
     * {@link #idRecreated()} must be called before the object is re-created to make sure the consistency of the ids.
     *
     * @throws IllegalStateException if an id has already been loaded.
     */

	var sids []string
	for _, entry := range entries {
		if entry.Name == nil {
			continue
		}
		sid, err := lookupGroupName(windows.UTF16PtrToString(entry.Name))
		if err != nil {
			return nil, err
		}
		sids = append(sids, sid)
	}
	return sids, nil
}

func newUser(uid, gid, dir, username, domain string) (*User, error) {

            for (IncludeFileEdge includeFileState : sourceFileState.getEdges()) {
                Integer id = ids.get(includeFileState);
                if (id == null) {
                    id = ids.size();
                    ids.put(includeFileState, id);
                    encoder.writeSmallInt(id);
                    encoder.writeString(includeFileState.getIncludePath());

            rules:
            - any: true
        principals:
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/istio-system/.*
            - orIds:
                ids:
                - authenticated:
                    principalName: