# OPA Quickstart Guide [![Slack](https://slack.minio.io/slack?type=svg)](https://slack.minio.io)

OPA is a lightweight general-purpose policy engine that can be co-located with MinIO server, in this document we talk about how to use OPA HTTP API to authorize requests. It can be used with any type of credentials (STS based like OpenID or LDAP, regular IAM users or service accounts).

OPA is enabled through MinIO's Access Management Plugin feature.

## Get started

	driveAPILatencyMicros        = "api_latency_micros"
	driveHealth                  = "health"

	driveOfflineCount = "offline_count"
	driveOnlineCount  = "online_count"
	driveCount        = "count"

	// iostat related
	driveReadsPerSec    = "reads_per_sec"
	driveReadsKBPerSec  = "reads_kb_per_sec"
	driveReadsAwait     = "reads_await"
	driveWritesPerSec   = "writes_per_sec"
	driveWritesKBPerSec = "writes_kb_per_sec"

	ARR                                   // -> Used on ARM for shift type 3, arithmetic right shift.
	ROT                                   // @> Used on ARM for shift type 4, rotate right.
	Include                               // included file started here
	BuildComment                          // //go:build or +build comment
	macroName                             // name of macro that should not be expanded

     */
    LEAST_LOADED,

    /**
     * Weighted random selection based on channel scores
     */
    WEIGHTED_RANDOM,

    /**
     * Affinity-based selection for related operations
     */
    AFFINITY_BASED,

    /**
     * Adaptive selection based on operation type and performance
     */
    ADAPTIVE

 * This exception is used to indicate errors that occur during the execution
 * of SSO authentication and authorization processes. It extends FessSystemException
 * to provide consistent error handling within the Fess system for SSO-related
 * processing failures such as token validation errors, communication failures
 * with SSO providers, or configuration issues.
 */
public class SsoProcessException extends FessSystemException {

the new API. This helps with our end-of-cycle audit of new APIs.
The same requirement applies to next/* (described below), which will
become a go1.XX.txt for XX >= 19.

The next/ directory contains the only files intended to be mutated.
Each file in that directory contains a list of features that may be added
to the next release of Go. The files in this directory only affect the
warning output from the go api tool. Each file should be named

    </module>

    <module name="MissingJavadocPackage">
        <property name="severity" value="warning"/>
        <message
            key="package.javadoc.missing"
            value="A description and other related documentation for a package should be written up in the package-info.java" />
    </module>

    <!-- Use our fork of this Checkstyle rule, so that we can ignore test classes -->

    assertSideEffectFree(hash);
    assertReadableBytes(hash);
  }

  private static void assertSideEffectFree(HashCode hash) {
    byte[] original = hash.asBytes();
    byte[] mutated = hash.asBytes();
    mutated[0]++;
    assertThat(hash.asBytes()).isEqualTo(original);
  }

  private static void assertReadableBytes(HashCode hashCode) {
    assertThat(hashCode.bits()).isAtLeast(32); // sanity

Because we are using a relative URL, if your API was located at `https://example.com/`, then it would refer to `https://example.com/token`. But if your API was located at `https://example.com/api/v1/`, then it would refer to `https://example.com/api/v1/token`.

the behavior you are seeing is confirmed as a bug or issue, it can easily be re-raised in the issue tracker.

## Filing issues

Sensitive security-related issues should be reported to [******@****.***](mailto:******@****.***).
See the [security policy](https://golang.org/security) for details.

The recommended way to file an issue is by running `go bug`.