.where(
                new TypeCapture<List<T>>() {}.capture(),
                new TypeCapture<List<? extends String>>() {}.capture())
            .resolveType(t));
    assertEquals(
        Types.supertypeOf(String.class),
        new TypeResolver()
            .where(
                new TypeCapture<List<T>>() {}.capture(),
                new TypeCapture<List<? super String>>() {}.capture())
            .resolveType(t));

	// use the normalized form of the entityName (which will be an LDAP DN).
	userType := IAMUserType(mapping.UserType)
	isGroup := mapping.IsGroup
	entityName := mapping.UserOrGroup
	if globalIAMSys.GetUsersSysType() == LDAPUsersSysType && userType == stsUser {

		// Validate that the user or group exists in LDAP and use the normalized

func (client *peerRESTClient) LoadPolicyMapping(ctx context.Context, userOrGroup string, userType IAMUserType, isGroup bool) error {
	_, err := loadPolicyMappingRPC.Call(ctx, client.gridConn(), grid.NewMSSWith(map[string]string{
		peerRESTUserOrGroup: userOrGroup,
		peerRESTUserType:    strconv.Itoa(int(userType)),
		peerRESTIsGroup:     strconv.FormatBool(isGroup),
	}))
	return err
}

	if err != nil {
		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
		return
	}

	replLogIf(ctx, globalSiteReplicationSys.IAMChangeHook(ctx, madmin.SRIAMItem{
		Type: madmin.SRIAMItemPolicyMapping,
		PolicyMapping: &madmin.SRPolicyMapping{
			UserOrGroup: entityName,
			UserType:    int(userType),
			IsGroup:     isGroup,

	ng := WithNPeers(len(sys.peerClients)).WithRetries(1)
	for idx, client := range sys.peerClients {
		client := client
		ng.Go(ctx, func() error {
			if client == nil {
				return errPeerNotReachable
			}
			return client.LoadPolicyMapping(ctx, userOrGroup, userType, isGroup)
		}, idx, *client.host)
	}