- All sites must be using the **same** external IDP(s) if any.
- For [SSE-S3 or SSE-KMS encryption via KMS](https://docs.min.io/community/minio-object-store/operations/server-side-encryption.html "MinIO KMS Guide"), all sites **must**  have access to a central KMS deployment. This can be achieved via a central KES server or multiple KES servers (say one per site) connected via a central KMS (Vault) server.

	{Encrypted: false, Metadata: map[string]string{"": ""}},                                        // 7
	{Encrypted: false, Metadata: map[string]string{"X-Minio-Internal-Server-Side-Encryption": ""}}, // 8
}

func TestIsEncrypted(t *testing.T) {
	for i, test := range isEncryptedTests {
		if _, isEncrypted := IsEncrypted(test.Metadata); isEncrypted != test.Encrypted {

// to create Client objects configured for SHA-512 hashing.
var KafkaSHA512 scram.HashGeneratorFcn = sha512.New

// XDGSCRAMClient implements the client-side of an authentication
// conversation with a server.  A new conversation must be created for
// each authentication attempt.
type XDGSCRAMClient struct {
	*scram.Client
	*scram.ClientConversation
	scram.HashGeneratorFcn

       * instance.
       */
      super("");
    }

    @Override
    Comparable<?> endpoint() {
      throw new IllegalStateException("range unbounded on this side");
    }

    @Override
    boolean isLessThan(Comparable<?> value) {
      return true;
    }

    @Override
    BoundType typeAsLowerBound() {
      throw new IllegalStateException();
    }

				return false
			}
		}
		return true
	}
	if !chkNumVersions(fivs.Versions) {
		t.Fatalf("Expected all versions to have the same NumVersions")
	}

	sort.Slice(versions, func(i, j int) bool {
		if versions[i].IsLatest {
			return true
		}
		if versions[j].IsLatest {
			return false
		}
		return versions[i].ModTime.After(versions[j].ModTime)
	})

			expectedErr: errors.New("only one server-side encryption rule is allowed at a time"),
			shouldPass:  false,
		},
		// 4. Invalid XML - master key ID present along with AES256
		{

// to create Client objects configured for SHA-512 hashing.
var KafkaSHA512 scram.HashGeneratorFcn = sha512.New

// XDGSCRAMClient implements the client-side of an authentication
// conversation with a server.  A new conversation must be created for
// each authentication attempt.
type XDGSCRAMClient struct {
	*scram.Client
	*scram.ClientConversation
	scram.HashGeneratorFcn

		n = copy(buf, cr.buffer[cr.offset:])
		if n == len(buf) {
			cr.offset += n
			return n, nil
		}
		cr.offset = 0
		buf = buf[n:]
	}
	// mustRead reads from input and compares against provided slice.
	mustRead := func(b ...byte) error {
		for _, want := range b {
			got, err := cr.reader.ReadByte()
			if err == io.EOF {
				return io.ErrUnexpectedEOF
			}
			if got != want {
				if cr.debug {

     * Tests the constructor of DosFileFilter.
     * This test ensures that the constructor runs without errors and correctly initializes the object.
     * The wildcard parameter is stored but its filtering logic is handled server-side,
     * so we only verify its acceptance here.
     */
    @Test
    void testConstructor() {
        // The constructor should not throw any exceptions with valid inputs.

			"B",
		),
		"THIS.\n",
	},
	{
		"nested #define with args",
		lines(
			"#define A #define B(x) x",
			"A",
			"B(THIS)",
		),
		"THIS.\n",
	},
	/* This one fails. See comment in Slice.Col.
	{
		"nested #define with args",
		lines(
			"#define A #define B (x) x",
			"A",
			"B(THIS)",
		),
		"x.\n",
	},
	*/
}

func TestLex(t *testing.T) {