}

	claims := make(map[string]any)
	for attribKey, attribValue := range lookupResult.Attributes {
		// we skip multi-value attributes here, as they cannot
		// be stored in the critical options.
		if len(attribValue) != 1 {
			continue
		}

		if attribKey == "sshPublicKey" && key != nil {
			key2, _, _, _, err := ssh.ParseAuthorizedKey([]byte(attribValue[0]))
			if err != nil {
				return nil, errSFTPPublicKeyBadFormat

			claims[ldapActualUser] = lookupResult.ActualDN
			claims[ldapUserN] = ctx.Sess.LoginUser()

			// Add LDAP attributes that were looked up into the claims.
			for attribKey, attribValue := range lookupResult.Attributes {
				claims[ldapAttribPrefix+attribKey] = attribValue
			}

			cred, err := auth.GetNewCredentialsWithMetadata(claims, globalActiveCred.SecretKey)
			if err != nil {
				return nil, err
			}

			return
		}

		// Add LDAP attributes that were looked up into the claims.
		for attribKey, attribValue := range lookupResult.Attributes {
			opts.claims[ldapAttribPrefix+attribKey] = attribValue
		}
	}

	newCred, updatedAt, err := globalIAMSys.NewServiceAccount(ctx, targetUser, targetGroups, opts)
	if err != nil {

		opts.claims[ldapActualUser] = lookupResult.ActualDN

		// Add LDAP attributes that were looked up into the claims.
		for attribKey, attribValue := range lookupResult.Attributes {
			opts.claims[ldapAttribPrefix+attribKey] = attribValue
		}

		// NOTE: if not using LDAP, then internal IDP or open ID is
		// being used - in the former, group info is enforced when