if s3Err != ErrNone {
			return nil, nil, false, errAuthentication
		}

		maps.Copy(claims.MapClaims, eclaims)

		// if root access is disabled, disable all its service accounts and temporary credentials.
		if ucred.ParentUser == globalActiveCred.AccessKey && !globalAPIConfig.permitRootAccess() {
			return nil, nil, false, errAccessKeyDisabled
		}

		// Now check if we have a sessionPolicy.

        try {
            final MessageDigest md4 = Crypto.getMD4();
            md4.update(Strings.getUNIBytes(tempStr));
            return md4.digest();
        } finally {
            // Clear the temporary string from memory (best effort)
            if (tempStr != null) {
                tempStr.intern();
            }
        }
    }

    /**
     * Generates the NTOWFv1 hash for the given password.

		return 0, err
	}

	// Done once per make.bash.
	if err := adbCopyGoroot(); err != nil {
		return 0, err
	}

	// Prepare a temporary directory that will be cleaned up at the end.
	// Binary names can conflict.
	// E.g. template.test from the {html,text}/template packages.
	binName := filepath.Base(os.Args[1])

    private PersistentHandleManager manager;
    private Path tempDir;

    @BeforeEach
    public void setUp() throws IOException {
        MockitoAnnotations.openMocks(this);

        // Create temporary directory for test state
        tempDir = Files.createTempDirectory("jcifs-test-handles");

        // Set system property for handle state directory

// descriptions for all the error responses.
var stsErrCodes = stsErrorCodeMap{
	ErrSTSAccessDenied: {
		Code:           "AccessDenied",
		Description:    "Generating temporary credentials not allowed for this request.",
		HTTPStatusCode: http.StatusForbidden,
	},
	ErrSTSMissingParameter: {
		Code:           "MissingParameter",

A user or application can now present a token to the `AssumeRoleWithCustomToken` API, and MinIO verifies this token by sending it to the Identity Management Plugin webhook. This plugin responds with some information and MinIO is able to generate temporary STS credentials to interact with object storage.

The authentication flow is similar to that of OpenID, however the token is "opaque" to MinIO - it is simply sent to the plugin for verification. CAVEAT: There is no console UI integration for...

- On finding at least one associated policy, MinIO generates temporary credentials for the user storing the list of groups in a cryptographically secure session token. The temporary access key, secret key and session token are returned to the user.
- The user can now use these credentials to make requests to the MinIO server.

        SSLSocketFactory sslSocketFactory = getSSLSocketFactory(curlHelper);
        assertNull(sslSocketFactory);
    }

    public void test_init_withInvalidSSLCertificate() {
        // Create a temporary invalid certificate file
        File invalidCertFile = null;
        try {
            invalidCertFile = File.createTempFile("invalid_cert", ".crt");
            try (FileWriter writer = new FileWriter(invalidCertFile)) {

    private static final long serialVersionUID = 1L;

    /**
     * Error severity levels
     */
    public enum Severity {
        RECOVERABLE, // Can retry the operation
        TRANSIENT, // Temporary error, retry after delay
        PERMANENT, // Operation cannot succeed
        FATAL // Connection or session must be terminated
    }

    /**
     * Error categories
     */
    public enum Category {

```

### Using WebIdentiy API

On another terminal run `web-identity.go` a sample client application which obtains JWT id_tokens from an identity provider, in our case its Keycloak. Uses the returned id_token response to get new temporary credentials from the MinIO server using the STS API call `AssumeRoleWithWebIdentity`.

```