"Resource": ["arn:aws:s3:::mybucket/${jwt:preferred_username}/*"]
	}
  ]
}
```

If the user is authenticating using an STS credential which was authorized from AD/LDAP we allow `ldap:*` variables.

Currently supports

- `ldap:username`
- `ldap:user`
- `ldap:groups`

Following example shows LDAP users full programmatic access to a LDAP user-specific directory (their own "home directory") in MinIO.

```
{

  public void awaitStopped(long timeout, TimeUnit unit) throws TimeoutException {
    state.awaitStopped(timeout, unit);
  }

  /**
   * Returns true if all services are currently in the {@linkplain State#RUNNING running} state.
   *
   * <p>Users who want more detailed information should use the {@link #servicesByState} method to
   * get detailed information about which services are not running.

  public void awaitStopped(long timeout, TimeUnit unit) throws TimeoutException {
    state.awaitStopped(timeout, unit);
  }

  /**
   * Returns true if all services are currently in the {@linkplain State#RUNNING running} state.
   *
   * <p>Users who want more detailed information should use the {@link #servicesByState} method to
   * get detailed information about which services are not running.

  // addressType specifies the type of address carried by this EndpointSlice.
  // All addresses in this slice must be the same type. This field is
  // immutable after creation. The following address types are currently
  // supported:
  // * IPv4: Represents an IPv4 Address.
  // * IPv6: Represents an IPv6 Address.
  // * FQDN: Represents a Fully Qualified Domain Name.
  optional string addressType = 4;

   * call cancel() and be unable to cancel the delegate.
   * There are a number of ways to solve this, none of which are very pretty, and it is currently
   * believed to be a purely theoretical problem (since the other actions should supply sufficient
   * write-barriers).
   */

  @CheckForNull @LazyInit private ListenableFuture<V> delegateRef;

	return fmt.Sprintf("| `%s` | `%s` | %s | %s |\n", md.Name, md.Type, md.Help, labels)
}

// listMetrics - returns a handler that lists all the metrics that could be
// returned for the requested path.
//
// FIXME: It currently only lists `minio_` prefixed metrics.
func (h *metricsV3Server) listMetrics(path string) http.Handler {
	// First collect all matching MetricsGroup's
	matchingMG := make(map[collectorPath]*MetricsGroup)

 *      <td>No</td>
 *      <td>Flags this Mojo as requiring the dependencies in the specified scope (or an implied scope) to be
 *          resolved before it can execute.
 *          <br>
 *          <i>NOTE: Currently supports <b>compile</b>, <b>runtime</b>, and <b>test</b> scopes.</i>
 *      </td>
 *   </tr>
 *   <tr>
 *      <td>description</td>
 *      <td>none (detected)</td>
 *      <td>No</td>

 * high-level APIs that provide autoescaping. For example, consider <a
 * href="http://www.xom.nu/">XOM</a> or <a href="http://www.jdom.org/">JDOM</a>.
 *
 * <p><b>Note:</b> Currently the escapers provided by this class do not escape any characters
 * outside the ASCII character range. Unlike HTML escaping the XML escapers will not escape

   * @return the count of the element before the operation; possibly zero
   * @throws IllegalArgumentException if {@code occurrences} is negative
   */
  /*
   * TODO(cpovirk): remove and removeExactly currently accept null inputs only
   * if occurrences == 0. This satisfies both NullPointerTester and
   * CollectionRemoveTester.testRemove_nullAllowed, but it's not clear that it's

  // +optional
  map<string, k8s.io.apimachinery.pkg.apis.meta.v1.Time> disruptedPods = 2;

  // Number of pod disruptions that are currently allowed.
  optional int32 disruptionsAllowed = 3;

  // current number of healthy pods
  optional int32 currentHealthy = 4;

  // minimum desired number of healthy pods
  optional int32 desiredHealthy = 5;