allow {
 input.owner == true
}

# All other users may do anything other than call PutObject
allow {
 input.action != "s3:PutObject"
 input.owner == false
}
EOF
```

Then load the policy via OPA's REST API.

```
curl -X PUT --data-binary @example.rego \
  localhost:8181/v1/policies/putobject
```

### 4. Setup MinIO with OPA

                    }
                    if (res == null) {
                        res = r.combine(next);
                    } else {
                        res.append(r.combine(next));
                    }
                } while (next != nextstart);
            }
        } while (r != start);

        if (res != null) {
            return res;
        }

        return dr;
    }

<manifest xmlns:android="http://schemas.android.com/apk/res/android" xmlns:tools="http://schemas.android.com/tools"
          package="okhttp.okhttp3">

  <uses-permission android:name="android.permission.INTERNET"/>

  <application>
    <provider
      android:name="androidx.startup.InitializationProvider"
      android:authorities="${applicationId}.androidx-startup"
      android:exported="false"
      tools:node="merge">

	}); err != nil {
		cancel()
		// Do not need to retry if we can't list objects on source.
		return err
	}
	failed := false
	for res := range results {
		if res.Err != nil {
			failed = true
			batchLogIf(ctx, res.Err)
			break
		}
		result := res.Item
		sseKMS := crypto.S3KMS.IsEncrypted(result.UserDefined)
		sseS3 := crypto.S3.IsEncrypted(result.UserDefined)

            SID user = new SID(buildSidT((byte) 1, ident, 10, 99), jcifs.SID.SID_TYPE_USER, "DOM", "alice", false);

            jcifs.SID[] res = user.getGroupMemberSids("srv", mockCtx, 0);

            assertNotNull(res);
            assertEquals(0, res.length);
            verify(mockResolver, never()).getGroupMemberSids(any(), anyString(), any(), anyInt(), anyInt());
        }

        @Test

/**
 */
// Just hide the one method we want behind the RepositorySystem interface.
@Deprecated
public interface ArtifactResolver {

    ArtifactResolutionResult resolve(ArtifactResolutionRequest request);

    // The rest is deprecated
    // USED BY MAVEN ASSEMBLY PLUGIN 2.2-beta-2
    @Deprecated
    String ROLE = ArtifactResolver.class.getName();

    // USED BY SUREFIRE, DEPENDENCY PLUGIN
    @Deprecated

        for (MetadataResult res : results) {
            ArtifactRepository repository = res.getRequest().getRepository();
            if (repository == null) {
                repository = request.getRepositorySession().getLocalRepository();
            }

            mergeMetadata(request.getRepositorySession(), trace, versions, res.getMetadata(), repository);
        }

			return
		}
	}

	res, err := authn.Authenticate(roleArn, token)
	if err != nil {
		writeSTSErrorResponse(ctx, w, ErrSTSInvalidParameterValue, err)
		return
	}

	// If authentication failed, return the error message to the user.
	if res.Failure != nil {
		writeSTSErrorResponse(ctx, w, ErrSTSUpstreamError, errors.New(res.Failure.Reason))
		return
	}

    return ImmutableSet.of(e1, e2, e3, e4, e5);
  }

  @Override
  protected <E extends Comparable<? super E>> Set<E> of(
      E e1, E e2, E e3, E e4, E e5, E e6, E... rest) {
    return ImmutableSet.of(e1, e2, e3, e4, e5, e6, rest);
  }

  @Override
  protected <E extends Comparable<? super E>> Set<E> copyOf(E[] elements) {
    return ImmutableSet.copyOf(elements);
  }

  @Override

			Optional:    true,
			Type:        "string",
		},
		config.HelpKV{
			Key:         KeyCloakAdminURL,
			Description: `Specify Keycloak 'admin' REST API endpoint e.g. http://localhost:8080/auth/admin/` + defaultHelpPostfix(KeyCloakAdminURL),
			Optional:    true,
			Type:        "string",
		},
		config.HelpKV{
			Key:         RedirectURIDynamic,