// Test if result matches.
			t.Errorf("Requested mismatch, want %v, got %v", Requested(test.Header), got)
		}
		got = got && S3KMS.IsRequested(test.Header)
		if got != test.Expected {
			t.Errorf("SSE-KMS: Test %d: Wanted %v but got %v", i, test.Expected, got)
		}
	}
	for i, test := range s3IsRequestedTests {
		_, got := IsRequested(test.Header)
		if Requested(test.Header) != got {
			// Test if result matches.

			}
			f.Close()
		}

		bs, err := os.ReadFile(goldenFile)
		if err != nil {
			t.Fatalf("opening golden.txt for package %q: %v", fi.Name(), err)
		}
		wanted := strings.Split(string(bs), "\n")
		sort.Strings(wanted)
		for _, feature := range wanted {
			if feature == "" {
				continue
			}
			_, ok := w.features[feature]
			if !ok {
				t.Errorf("package %s: missing feature %q", fi.Name(), feature)
			}

| policy     | _string_ or _[]string_ or _comma_separated_value_ | Canned policy name to be applied for STS credentials. (Mandatory) - This can be configured to any desired value such as `roles` or `groups` by setting the environment variable `MINIO_IDENTITY_OPENID_CLAIM_NAME` |

## Get started

| Params        | Value                                          |
| :--           | :--                                            |

Use [`mc admin policy`](https://min.io/docs/minio/linux/reference/minio-mc-admin/mc-admin-policy.html#command-mc.admin.policy) to create custom admin policies.

Create new canned policy file `adminManageUser.json`. This policy enables admin user to
manage other users.

```json
cat > adminManageUser.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [

// error returned in IAM subsystem when a group is disabled
var errGroupDisabled = errors.New("Specified group is disabled")

// error returned in IAM subsystem when policy doesn't exist.
var errNoSuchPolicy = errors.New("Specified canned policy does not exist")

// error returned when policy to be deleted is in use.
var errPolicyInUse = errors.New("Specified policy is in use and cannot be deleted.")

client_id     (string)    unique public identifier for apps e.g. "292085223830.apps.googleusercontent.com"
claim_name    (string)    JWT canned policy claim name, defaults to "policy"
claim_prefix  (string)    JWT claim namespace prefix e.g. "customer1/"

  static final ImmutableList<PairedStats> ALL_PAIRED_STATS =
      ImmutableList.of(
          EMPTY_PAIRED_STATS,
          ONE_VALUE_PAIRED_STATS,
          TWO_VALUES_PAIRED_STATS,
          MANY_VALUES_PAIRED_STATS,
          DUPLICATE_MANY_VALUES_PAIRED_STATS,
          HORIZONTAL_VALUES_PAIRED_STATS,
          VERTICAL_VALUES_PAIRED_STATS,
          CONSTANT_VALUES_PAIRED_STATS);

  // Helper methods:

		},
	}
	for _, tt := range tests {
		t.Run(tt.description, func(t *testing.T) {
			gotNs := handleNamespace(tt.namespace, tt.defaultNamespace)
			if gotNs != tt.wantNamespace {
				t.Fatalf("unexpected namespace: wanted %v got %v", tt.wantNamespace, gotNs)
			}
		})
	}

                    label selector matches all objects. A null label selector matches
                    no objects.
                  properties:
                    matchExpressions:
                      description: matchExpressions is a list of label selector requirements.
                        The requirements are ANDed.
                      items: