List<jcifs.SID> groups = map.get(mems[ mi ]);
                            if ( groups == null ) {
                                groups = new ArrayList<>();
                                map.put(mems[ mi ], groups);
                            }
                            if ( !groups.contains(groupSid) )
                                groups.add(groupSid);
                        }

		// return that info. Otherwise we return error.
		var groups []string
		for _, v := range cache.iamUsersMap {
			if v.Credentials.ParentUser == name {
				groups = v.Credentials.Groups
				break
			}
		}
		for _, v := range cache.iamSTSAccountsMap {
			if v.Credentials.ParentUser == name {
				groups = v.Credentials.Groups
				break
			}
		}

 *       <i>j</i><sup>th</sup> item in the <i>i</i><sup>th</sup> equality group, where both equality
 *       groups and the items within equality groups are numbered starting from 1. When either a
 *       constructor argument or an equal object is provided, that becomes group 1.
 * </ul>
 *
 * @author Jim McMaster
 * @author Jige Yu
 * @since 10.0
 */
@GwtCompatible

            "type" : "keyword"
          },
          "gidNumber" : {
            "type" : "long"
          },
          "givenName" : {
            "type" : "keyword"
          },
          "groups" : {
            "type" : "keyword"
          },
          "homeDirectory" : {
            "type" : "keyword"
          },
          "homePhone" : {
            "type" : "keyword"
          },

 *       <i>j</i><sup>th</sup> item in the <i>i</i><sup>th</sup> equality group, where both equality
 *       groups and the items within equality groups are numbered starting from 1. When either a
 *       constructor argument or an equal object is provided, that becomes group 1.
 * </ul>
 *
 * @author Jim McMaster
 * @author Jige Yu
 * @since 10.0
 */
@GwtCompatible

    String scopes = "channels:history channels:read channels:write chat:write:bot chat:write:user "
        + "dnd:read dnd:write emoji:read files:read files:write:user groups:history groups:read "
        + "groups:write im:history im:read im:write mpim:history mpim:read mpim:write pins:read "
        + "pins:write reactions:read reactions:write search:read stars:read stars:write team:read "

                            logger.debug("Failed to access parent groups: {}", contentMap);
                        } else {
                            logger.warn("Failed to access parent groups: {}", contentMap);
                        }
                    }
                } catch (final IOException e) {
                    logger.warn("Failed to access groups/roles in AzureAD.", e);
                }

                    ArrayList groups = (ArrayList)map.get(mems[mi]);
                    if (groups == null) {
                        groups = new ArrayList();
                        map.put(mems[mi], groups);
                    }
                    if (!groups.contains(groupSid))
                        groups.add(groupSid);
                }
            }

			return
		}

		cred := auth.Credentials{
			AccessKey: claims.AccessKey,
			Claims:    claims.Map(),
			Groups:    groups,
		}

		// For authenticated users apply IAM policy.
		if !globalIAMSys.IsAllowed(policy.Args{
			AccountName:     cred.AccessKey,
			Groups:          cred.Groups,
			Action:          policy.PrometheusAdminAction,
			ConditionValues: getConditionValues(r, "", cred),

		if _, ok = eclaims[policy.SessionPolicyName]; ok {
			owner = false
		} else {
			owner = globalActiveCred.AccessKey == ucred.ParentUser
		}

		groups = ucred.Groups
	}

	return claims, groups, owner, nil
}

// newCachedAuthToken returns a token that is cached up to 15 seconds.
// If globalActiveCred is updated it is reflected at once.