assertNotNull("Allow-Origin header should be set", responseHeaders.get("Access-Control-Allow-Origin"));
        assertNotNull("Allow-Methods header should be set", responseHeaders.get("Access-Control-Allow-Methods"));
        assertNotNull("Allow-Headers header should be set", responseHeaders.get("Access-Control-Allow-Headers"));
        assertNotNull("Max-Age header should be set", responseHeaders.get("Access-Control-Max-Age"));

if [ $? -ne 0 ]; then
	echo "expecting bucket to be present. exiting.."
	exit_1
fi

./mc stat --no-list minio3/newbucket
if [ $? -ne 0 ]; then
	echo "expecting bucket to be present. exiting.."
	exit_1
fi

./mc cp README.md minio2/newbucket/

sleep 5
./mc stat --no-list minio1/newbucket/README.md
if [ $? -ne 0 ]; then
	echo "expecting object to be present. exiting.."
	exit_1
fi

        assertNotNull(lsarSidArrayX.sids, "sids array should not be null");
        assertEquals(2, lsarSidArrayX.sids.length, "sids array length should match");
        assertEquals(sidT1, lsarSidArrayX.sids[0].sid, "First SID should be unwrapped correctly");
        assertEquals(sidT2, lsarSidArrayX.sids[1].sid, "Second SID should be unwrapped correctly");
    }

    @Test

## Request and Response

MinIO will make a `POST` request with a JSON body to the given plugin URL. If the auth token parameter is set, it will be sent as an authorization header.

The JSON body structure can be seen from this sample:

<details><summary>Request Body Sample</summary>

```json
{
  "input": {
    "account": "minio",
    "groups": null,
    "action": "s3:ListBucket",

    void testSMB2FlagConsistency() {
        // SMB1 should not be SMB2
        assertFalse(DialectVersion.SMB1.isSMB2());

        // All other versions should be SMB2
        for (DialectVersion version : DialectVersion.values()) {
            if (version != DialectVersion.SMB1) {
                assertTrue(version.isSMB2(), "Version " + version + " should be SMB2");
            }
        }
    }

    @Test

                    for (int i = 0; i < opsPerThread; i++) {
                        String share = "share" + (threadId % 3); // Use 3 different shares

                        // Get or create tree
                        SmbTreeImpl tree = session.getSmbTree(share, null);
                        assertNotNull(tree, "Tree should not be null");

	for i := range 10 {
		// All the objects should be under deleted list (including non-existent object)
		c.Assert(deleteResp.DeletedObjects[i], DeletedObject{
			ObjectName: delObjReq.Objects[i].ObjectName,
			VersionID:  delObjReq.Objects[i].VersionID,
		})
	}
	c.Assert(len(deleteResp.Errors), 0)

	// Attempt second time results should be same, NoSuchKey for objects not found
	// shouldn't be set.

- Root credentials can now be changed easily. Before, a two-step process was required to
   change the cluster root credentials since they were used to en/decrypt the IAM data.
   So, both - the old and new credentials - had to be present at the same time during a rotation
   and the old credentials had to be removed once the rotation completed. This process is now gone.
   The root credentials can now be changed easily.

       execution it sees that the classpath has changed, and so to be
       safe, it needs to re-run.

       - This is unfortunate, because actually it would be safe to declare
       the task as up-to-date, because these two files, which are based on
       the generated index.xml, are outputs, not inputs. We can be sure of
       this because they are deleted in the @BeforeEach method of the

        // THEN the result should be an empty list
        assertNotNull(result, "The result should not be null.");
        assertTrue(result.isEmpty(), "The result should be empty for unknown auth types.");
    }

    /**
     * Test parsing of {@link KerberosConstants#AUTH_DATA_PAC} with an invalid token.
     * Expects a {@link PACDecodingException} to be thrown.
     */
    @Test