pk.RLock()
	defer pk.RUnlock()
	return pk.pkMap[kid]
}

// PopulatePublicKey - populates a new publickey from the JWKS URL.
func (r *Config) PopulatePublicKey(arn arn.ARN) error {
	pCfg := r.arnProviderCfgsMap[arn]
	if pCfg.JWKS.URL == nil || pCfg.JWKS.URL.String() == "" {
		return nil
	}

	// Add client secret for the client ID for HMAC based signature.

			continue // skip if not the type we want
		}
		arn, ok := accessKey.Claims[roleArnClaim].(string)
		if !ok {
			if _, ok := accessKey.Claims[iamPolicyClaimNameOpenID()]; !ok {
				continue // skip if no roleArn and no policy claim
			}
			// claim-based provider is in the roleArnMap under dummy ARN
			arn = dummyRoleARN
		}
		matchingCfgName, ok := roleArnMap[arn]
		if !ok {

		tid         TargetID
		region      string
		expectedARN ARN
	}{
		{tid, "", ARN{TargetID: tid, region: ""}},
		{tid, "us-east-1", ARN{TargetID: tid, region: "us-east-1"}},
	}

	for i, testCase := range testCases {
		arn := testCase.tid.ToARN(testCase.region)

		if arn != testCase.expectedARN {
			t.Fatalf("test %v: ARN: expected: %v, got: %v", i+1, testCase.expectedARN, arn)
		}
	}
}

		tid         TargetID
		region      string
		expectedARN ARN
	}{
		{tid, "", ARN{TargetID: tid, region: ""}},
		{tid, "us-east-1", ARN{TargetID: tid, region: "us-east-1"}},
	}

	for i, testCase := range testCases {
		arn := testCase.tid.ToARN(testCase.region)

		if arn != testCase.expectedARN {
			t.Fatalf("test %v: ARN: expected: %v, got: %v", i+1, testCase.expectedARN, arn)
		}
	}
}

			OpType:    replication.ResyncReplicationType,
			TargetArn: arn,
		})

	if len(tgtArns) == 0 {
		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErrWithErr(ErrBadRequest, InvalidArgument{
			Bucket: bucket,
			Err:    fmt.Errorf("Remote target ARN %s missing or ineligible for replication resync", arn),
		}), r.URL)
		return
	}

	if len(tgtArns) > 1 && arn == "" {

> NOTE: If you are using a mc version below `RELEASE.2022-12-24T15-21-38Z`, the --remote-bucket flag needs an ARN generated by `mc admin bucket remote add` command. For  mc versions RELEASE.2021-09-02T09-21-27Z and older, the remote target ARN needs to be passed in the --arn flag and actual remote bucket name in --remote-bucket flag of  `mc replicate add`. For example, in older releases of mc replication configuration used to be added with:

```

			rs.set(ri.Arn, ri.Size, 0, status, ri.OpType, ri.endpoint, ri.secure, ri.Err)
		}
	case replication.Completed:
		if ri.OpType.IsDataReplication() {
			rs.set(ri.Arn, ri.Size, ri.Duration, status, ri.OpType, ri.endpoint, ri.secure, ri.Err)
		}
	case replication.Failed:
		if ri.OpType.IsDataReplication() && prevStatus == replication.Pending {

                                                            arg0="${f:h(q)}" arg1="${f:h(allRecordCount)}"
                                                            arg2="${f:h(currentStartRecordNumber)}"
                                                            arg3="${f:h(currentEndRecordNumber)}"/>
                                            </c:if><c:if test="${allRecordCountRelation!='EQUAL_TO'}">

					arg0="${displayQuery}" arg1="${fe:formatNumber(allRecordCount,'###,###')}"
					arg2="${f:h(currentStartRecordNumber)}"
					arg3="${f:h(currentEndRecordNumber)}" />
			</c:if><c:if test="${allRecordCountRelation!='EQUAL_TO'}">
				<la:message key="labels.search_result_status_over"
					arg0="${displayQuery}" arg1="${fe:formatNumber(allRecordCount,'###,###')}"
					arg2="${f:h(currentStartRecordNumber)}"
					arg3="${f:h(currentEndRecordNumber)}" />

After configuring the plugin, use the generated Role ARN with `AssumeRoleWithCustomToken` to get temporary credentials to access object storage.

## API Request

To make an STS API request with this method, send a POST request to the MinIO endpoint with following query parameters: