- Client sends HTTP `POST` request over a TLS connection hitting the MinIO TLS STS API.
- MinIO verifies that the client certificate is valid.
- MinIO tries to find a policy that matches the `CN` of the client certificate.
- MinIO returns temp. S3 credentials associated to the found policy.

 * available online).
 * <p>
 * Direct ACEs are evaluated first in order. The SID of the user performing
 * the operation and the desired access bits are compared to the SID
 * and access mask of each ACE. If the SID matches, the allow/deny flags
 * and access mask are considered. If the ACE is a "deny"
 * ACE and <i>any</i> of the desired access bits match bits in the access
 * mask of the ACE, the whole access check fails. If the ACE is an "allow"

      }
      Alphabet lowerCase = new Alphabet(name + ".lowerCase()", lowerCased);
      return ignoreCase ? lowerCase.ignoreCase() : lowerCase;
    }

    public boolean matches(char c) {
      return c < decodabet.length && decodabet[c] != -1;
    }

    @Override
    public String toString() {
      return name;
    }

    @Override

    }

    protected HtmlResponse doSearch(final ListForm form) {
        validate(form, messages -> {}, this::asListHtml);

        if (StringUtil.isBlank(form.q)) {
            // query matches on all documents.
            form.q = Constants.MATCHES_ALL_QUERY;
        }
        final WebRenderData renderData = new WebRenderData();
        form.initialize();

    FIRST,
    SECOND,
    THIRD;
  }

  // Given a sequence of lock acquisition descriptions
  // (e.g. "LockA -> LockB", "LockB -> LockC", ...)
  // Checks that the exception.getMessage() matches a regex of the form:
  // "LockA -> LockB \b.*\b LockB -> LockC \b.*\b LockC -> LockA"
  private void checkMessage(IllegalStateException exception, String... expectedLockCycle) {

    FIRST,
    SECOND,
    THIRD;
  }

  // Given a sequence of lock acquisition descriptions
  // (e.g. "LockA -> LockB", "LockB -> LockC", ...)
  // Checks that the exception.getMessage() matches a regex of the form:
  // "LockA -> LockB \b.*\b LockB -> LockC \b.*\b LockC -> LockA"
  private void checkMessage(IllegalStateException exception, String... expectedLockCycle) {

                rawType.isPrimitive() ? Key.get(rawType).getTypeLiteral() : toType;

        for (final TypeConverterBinding b : typeConverterBindings) {
            if (b.getTypeMatcher().matches(boxedType)) {
                return b.getTypeConverter().convert(text, toType);
            }
        }

        // last chance => attempt to create an instance of the expected type: use the string if non-empty

   | server for that repository.
   |-->
  <mirrors>
    <!-- mirror
     | Specifies a repository mirror site to use instead of a given repository. The repository that
     | this mirror serves has an ID that matches the mirrorOf element of this mirror. IDs are used
     | for inheritance and direct lookup purposes, and must be unique across the set of mirrors.
     |
    <mirror>
      <id>mirrorId</id>

    @Execute
    public JsonResponse<ApiResult> docs(final SearchBody body) {
        validateApi(body, messages -> {});

        if (StringUtil.isBlank(body.q)) {
            // query matches on all documents.
            body.q = Constants.MATCHES_ALL_QUERY;
        }

        final SearchRenderData renderData = new SearchRenderData();
        body.initialize();
        try {

        assertSame(mirrorC, mirrorSelector.getMirror(getRepo("c", "http://c.c"), mirrors));
    }

    @Test
    void testMirrorStopOnFirstMatch() {
        // exact matches win first
        Mirror mirrorA2 = newMirror("a2", "a,b", "http://a2");
        Mirror mirrorA = newMirror("a", "a", "http://a");
        // make sure repeated entries are skipped