OPA is a lightweight general-purpose policy engine that can be co-located with MinIO server, in this document we talk about how to use OPA HTTP API to authorize requests. It can be used with any type of credentials (STS based like OpenID or LDAP, regular IAM users or service accounts).

OPA is enabled through MinIO's Access Management Plugin feature.

## Get started

### 1. Start OPA in a container

```sh
podman run -it \

        return StringUtil.isBlank(s) ? StringUtil.EMPTY : "/" + s;
    }

    /**
     * Gets the virtual host key from the current request.
     * The key is determined by matching HTTP headers against configured virtual hosts.
     *
     * @return The virtual host key, or empty string if no match found
     */
    public String getVirtualHostKey() {

    fix insecure hosts crash with an `IllegalArgumentException` on Android.


## Version 4.7.0

_2020-05-17_

 *  New: `HandshakeCertificates.Builder.addInsecureHost()` makes it easy to turn off security in
    private development environments that only carry test data. Prefer this over creating an
    all-trusting `TrustManager` because only hosts on the allowlist are insecure. From

# Maximum concurrent group results for collapse queries.
query.collapse.max.concurrent.group.results=4
# Inner hits name for collapse queries.
query.collapse.inner.hits.name=similar_docs
# Inner hits size for collapse queries.
query.collapse.inner.hits.size=0
# Sorts for inner hits in collapse queries.
query.collapse.inner.hits.sorts=
# Default languages for queries.
query.default.languages=
# Default preference for JSON queries.

    }

    @SuppressWarnings("unchecked")
    default Tuple3<String, String, String>[] getVirtualHosts() {
        Tuple3<String, String, String>[] hosts = (Tuple3<String, String, String>[]) propMap.get(VIRTUAL_HOST_HEADERS);
        if (hosts == null) {
            hosts = split(getVirtualHostHeaderValue(), "\n").get(stream -> stream.map(s -> {
                final String[] v1 = s.split("=");
                if (v1.length == 2) {

 * the client and may be necessary for proper operation.
 * <p>
 * This class should be used in favor of {@code InetAddress} to resolve
 * hostnames on LANs and WANs that support a mixture of NetBIOS/WINS and
 * DNS resolvable hosts.
 */

public class UniAddress implements Address {

    /**
     * Check whether a hostname is actually an ip address
     *
     * @param hostname the hostname to check

  override fun noNewExchanges() {
    withLock {
      noNewExchanges = true
    }
    connectionListener.noNewExchanges(this)
  }

  /** Prevent this connection from being used for hosts other than the one in [route]. */
  internal fun noCoalescedConnections() {
    withLock {
      noCoalescedConnections = true
    }
  }

  internal fun incrementSuccessCount() {
    withLock {

* `www_redirect` - If set to True, requests to non-www versions of the allowed hosts will be redirected to their www counterparts. Defaults to `True`.

If an incoming request does not validate correctly then a `400` response will be sent.

## `GZipMiddleware` { #gzipmiddleware }

### Expiry or removal events

An object that is in transition tier will be deleted once the object hits expiry date or if removed via `mc rm` (`mc rm --vid` in the case of delete of a specific object version). Other rules specific to legal hold and object locking precede any lifecycle rules.

### Additional notes

  /** Returns the number of times {@link Cache} lookup methods have returned a cached value. */
  public long hitCount() {
    return hitCount;
  }

  /**
   * Returns the ratio of cache requests which were hits. This is defined as {@code hitCount /
   * requestCount}, or {@code 1.0} when {@code requestCount == 0}. Note that {@code hitRate +
   * missRate =~ 1.0}.
   */
  public double hitRate() {