### 2. Create a new admin user with CreateUser, DeleteUser and ConfigUpdate permissions

Use [`mc admin policy`](https://min.io/docs/minio/linux/reference/minio-mc-admin/mc-admin-policy.html#command-mc.admin.policy) to create custom admin policies.

Create new canned policy file `adminManageUser.json`. This policy enables admin user to
manage other users.

```json
cat > adminManageUser.json << EOF
{
  "Version": "2012-10-17",

            key8[ i ] ^= Integer.bitCount(key8[ i ] ^ 1) & 1;
        }
        return key8;
    }

    /**
     * Default provider is BouncyCastleProvider.
     * For registering custom provider
     * @see jcifs.util.Crypto#initProvider(Provider)
     * @return Provider
     */
    public static Provider getProvider() {
        if (provider != null) {
            return provider;
        }

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        tools: latest
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.

- **Focus**:
  1. Deployment of Istio using Helm charts.
  1. Verification of Helm chart configurations.
  1. Testing of Helm chart upgrades and rollbacks.
  1. Validation of custom Helm values and overrides.
  1. Ensuring compatibility with different Kubernetes versions.
- **Setup**: The main test setup in this folder initializes the Istio control plane using Helm charts.

### Security Integration Tests

When configured, MinIO sends request and credential details for every API call to an external HTTP(S) endpoint and expects an allow/deny response. MinIO is thus able to delegate access management to an external system, and users are able to use a custom solution instead of S3 standard IAM policies.

            data["client_secret"] = form_data.client_secret
        return data
    ```

    Note that for OAuth2 the scope `items:read` is a single scope in an opaque string.
    You could have custom internal logic to separate it by colon characters (`:`) or
    similar, and get the two parts `items` and `read`. Many applications do that to
    group and organize permissions, you could do it as well in your application, just

 *
 * This works because those types each implement {@code PredecessorsFunction}. It will also work
 * with any other implementation of this interface.
 *
 * <p>If you have your own graph implementation based around a custom node type {@code MyNode},
 * which has a method {@code getParents()} that retrieves its predecessors in a graph:
 *
 * <pre>{@code
 * someGraphAlgorithm(startNode, MyNode::getParents);
 * }</pre>
 *

It might also help avoid confusion for new developers that see an unused parameter in your code and could think it's unnecessary.

///

/// info

In this example we use invented custom headers `X-Key` and `X-Token`.

But in real cases, when implementing security, you would get more benefits from using the integrated [Security utilities (the next chapter)](../security/index.md){.internal-link target=_blank}.

////

/// tip

You could use the same technique to extend the JSON Schema and add your own custom extra info.

For example you could use it to add metadata for a frontend user interface, etc.

///

/// info

	EventKind   = madmin.LogKindEvent
	InfoKind    = madmin.LogKindInfo
)

var (
	// DisableLog avoids printing error/event/info kind of logs
	DisableLog = false
	// Output allows configuring custom writer, defaults to os.Stderr
	Output io.Writer = os.Stderr
)

var trimStrings []string

// TimeFormat - logging time format.
const TimeFormat string = "15:04:05 MST 01/02/2006"