{
    "Version": "2012-10-17",
    "Statement": [
    {
        "Action": [
            "admin:SetBucketTarget",
            "admin:GetBucketTarget"
        ],
        "Effect": "Allow",
        "Sid": ""
     }, 
     {
      "Effect": "Allow",
      "Action": [
       "s3:GetReplicationConfiguration",
       "s3:PutReplicationConfiguration",
       "s3:ListBucket",
       "s3:ListBucketMultipartUploads",

        if (LogStream.level >= 3) {
            log.println("doFindFirstNext: " + req.path);
        }

        send(req, resp);

        sid = resp.sid;
        req = new Trans2FindNext2(sid, resp.resumeKey, resp.lastName);

        /* The only difference between first2 and next2 responses is subCommand
         * so let's recycle the response object.
         */

        buffer.putInt(60); // DACL offset

        // Owner SID at offset 20
        buffer.position(20);
        buffer.put((byte) 0x01); // Revision
        buffer.put((byte) 0x01); // SubAuthorityCount
        buffer.put(new byte[] { 0, 0, 0, 0, 0, 1 }); // IdentifierAuthority
        buffer.putInt(0); // SubAuthority

        // Group SID at offset 40
        buffer.position(40);

			[in] uint32_t unknown,
			[in] uint32_t access_mask,
			[out] policy_handle *handle);

	[op(0x07)]
	int SamrOpenDomain([in] policy_handle *handle,
			[in] uint32_t access_mask,
			[in] sid_t *sid,
			[out] policy_handle *domain_handle);

	typedef struct {
		uint32_t idx;
		unicode_string name;
	} SamrSamEntry;

	typedef struct {
		uint32_t count;
		[size_is(count)] SamrSamEntry *entries;

        requestBody.put("q", "Example Domain");
        checkMethodBase(requestBody).delete("/api/admin/searchlist/query");
        refresh();

        for (String sId : getSchedulerIds(NAME_PREFIX)) {
            deleteMethod("/api/admin/scheduler/setting/" + sId);
        }

        for (String fId : getFileConfigIds(NAME_PREFIX)) {
            deleteMethod("/api/admin/fileconfig/setting/" + fId);
        }

    }

    @Override
    public SID getOwnerUser() throws IOException {
        return getOwnerUser(true);
    }

    @Override
    public SID getOwnerUser(final boolean resolve) throws IOException {
        try (SmbTreeHandleImpl th = ensureTreeConnected()) {
            final SecurityDescriptor desc = querySecurity(th, SecurityInfo.OWNER_SECURITY_INFO);
            final SID ownerUser = desc.getOwnerUserSid();

        assertNotNull(capturedRpc);
        assertEquals(mockPolicyHandle, capturedRpc.handle);
        assertEquals(access, capturedRpc.access_mask);
        assertEquals(mockSid, capturedRpc.sid);
        assertEquals(handle, capturedRpc.domain_handle); // Ensure the handle itself is passed for output
    }

    @Test
    void constructor_shouldThrowSmbExceptionOnRpcError() throws IOException {
        // Arrange

	bucketPolicyTemplate := `{"Version":"2012-10-17","Statement":[{"Sid":"","Effect":"Allow","Principal":{"AWS":["*"]},"Action":["s3:GetBucketLocation","s3:ListBucket"],"Resource":["arn:aws:s3:::%s"]},{"Sid":"","Effect":"Allow","Principal":{"AWS":["*"]},"Action":["s3:GetObject"],"Resource":["arn:aws:s3:::%s/this*"]}]}`

```json
cat > getonly.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
	{
	  "Action": [
		"s3:GetObject"
	  ],
	  "Effect": "Allow",
	  "Resource": [
		"arn:aws:s3:::my-bucketname/*"
	  ],
	  "Sid": ""
	}
  ]
}
EOF
```

Create new canned policy by name `getonly` using `getonly.json` policy file.

```
mc admin policy create myminio getonly getonly.json
```

```
{
 "Version": "2012-10-17",
 "Statement": [
  {
    "Action": [
        "admin:SetBucketTarget",
        "admin:GetBucketTarget"
    ],
    "Effect": "Allow",
    "Sid": ""
  },
  {
   "Effect": "Allow",
   "Action": [
    "s3:GetReplicationConfiguration",
    "s3:PutReplicationConfiguration",
    "s3:ListBucket",
    "s3:ListBucketMultipartUploads",