u.Credentials.Claims = jwtClaims.Map()
	}
	if u.Credentials.Description == "" {
		u.Credentials.Description = u.Credentials.Comment
	}

	m[user] = u
	return nil
}

func (ies *IAMEtcdStore) loadSecretKey(ctx context.Context, user string, userType IAMUserType) (string, error) {
	var u UserIdentity
	err := ies.loadIAMConfig(ctx, &u, getUserIdentityPath(user, userType))
	if err != nil {

		policyName := path.Dir(item.Item)
		if err := iamOS.loadPolicyDoc(ctx, policyName, m); err != nil && !errors.Is(err, errNoSuchPolicy) {
			return err
		}
	}
	return nil
}

func (iamOS *IAMObjectStore) loadSecretKey(ctx context.Context, user string, userType IAMUserType) (string, error) {
	var u UserIdentity
	err := iamOS.loadIAMConfig(ctx, &u, getUserIdentityPath(user, userType))
	if err != nil {

	loadPolicyDocs(ctx context.Context, m map[string]PolicyDoc) error
	loadUser(ctx context.Context, user string, userType IAMUserType, m map[string]UserIdentity) error
	loadSecretKey(ctx context.Context, user string, userType IAMUserType) (string, error)
	loadUsers(ctx context.Context, userType IAMUserType, m map[string]UserIdentity) error

	s.RLock()
	secretKey := s.secretKey
	s.RUnlock()

	if secretKey != "" {
		return secretKey, nil
	}

	secretKey, err := globalIAMSys.store.loadSecretKey(ctx, siteReplicatorSvcAcc, svcUser)
	if err != nil {
		return "", err
	}
	s.Set(secretKey)
	return secretKey, nil
}

func (s *siteReplicatorCred) Set(secretKey string) {
	s.Lock()