}

verify_iam_content_in_new_minio() {
	output=$(mc idp ldap policy entities new-minio --json)

	groups=$(echo "$output" | jq -r '.result.policyMappings[] | select(.policy == "readwrite") | .groups[]')
	if [ "$groups" != "cn=project.c,ou=groups,ou=swengg,dc=min,dc=io" ]; then
		echo "Failed to verify groups: $groups"
		exit 1
	fi

	}

	// Bind to the lookup user account again to perform group search.
	if err = l.LDAP.LookupBind(conn); err != nil {
		return nil, nil, err
	}

	// User groups lookup.
	groups, err := l.LDAP.SearchForUserGroups(conn, username, lookupResult.ActualDN)
	if err != nil {
		return nil, nil, err
	}

	return lookupResult, groups, nil
}

// GetExpiryDuration - return parsed expiry duration.

us":"on","name":"","description":"","expiration":"1970-01-01T00:00:00Z"},"dillon-svcacct-1":{"parent":"uid=dillon,ou=people,ou=swengg,dc=min,dc=io","accessKey":"dillon-svcacct-1","secretKey":"dillon-svcacct-1","groups":["cn=projecta,ou=groups,ou=swengg,dc=min,dc=io","cn=projectb,ou=groups,ou=swengg,dc=min,dc=io"],"claims":{"accessKey":"dillon-svcacct-1","ldapActualUser":"uid=dillon,ou=people,ou=swengg,dc=min,dc=io","ldapUser":"uid=dillon,ou=people,ou=swengg,dc=min,dc=io","ldapUsername":"dillon",...

						return
					}
				}
				if _, gerr := globalIAMSys.AddUsersToGroup(ctx, group, grpInfo.Members); gerr != nil {
					failed.Groups = append(failed.Groups, madmin.IAMErrEntity{Name: group, Error: err})
				} else {
					added.Groups = append(added.Groups, group)
				}
			}
		}
	}

	// import service accounts
	{

 *       groups and the items within equality groups are numbered starting from 1. When either a
 *       constructor argument or an equal object is provided, that becomes group 1.
 * </ul>
 *
 * @author Jim McMaster
 * @author Jige Yu
 * @since 10.0
 */
@GwtCompatible
@NullMarked
public final class EqualsTester {
  private static final int REPETITIONS = 3;

			AccountName:     cred.AccessKey,
			Groups:          cred.Groups,
			Action:          policy.BypassGovernanceRetentionAction,
			BucketName:      bucketName,
			ObjectName:      objectName,
			ConditionValues: conditions,
			IsOwner:         owner,
			Claims:          cred.Claims,
		})
	}
	if globalIAMSys.IsAllowed(policy.Args{
		AccountName:     cred.AccessKey,
		Groups:          cred.Groups,

## Dependencies for groups of *path operations* { #dependencies-for-groups-of-path-operations }

		if _, ok = eclaims[policy.SessionPolicyName]; ok {
			owner = false
		} else {
			owner = globalActiveCred.AccessKey == ucred.ParentUser
		}

		groups = ucred.Groups
	}

	return claims, groups, owner, nil
}

// newCachedAuthToken returns the cached token.
func newCachedAuthToken() func() string {
	return func() string {
		return globalNodeAuthToken
	}

			continue
		}
		groups.Remove(group)
		c.iamUserGroupMemberships[member] = groups
	}
}

func (c *iamCache) policyDBGetGroups(store *IAMStoreSys, userPolicyPresent bool, groups ...string) ([]string, error) {
	var policies []string
	for _, group := range groups {
		if store.getUsersSysType() == MinIOUsersSysType {
			g, ok := c.iamGroupsMap[group]
			if !ok {
				continue
			}

	if _, ok := args["groups"]; !ok {
		if len(groups) > 0 {
			args["groups"] = groups
		}
	}

	return args
}

// PolicyToBucketAccessPolicy converts a MinIO policy into a minio-go policy data structure.
func PolicyToBucketAccessPolicy(bucketPolicy *policy.BucketPolicy) (*miniogopolicy.BucketAccessPolicy, error) {