// descriptions for all the error responses.
var stsErrCodes = stsErrorCodeMap{
	ErrSTSAccessDenied: {
		Code:           "AccessDenied",
		Description:    "Generating temporary credentials not allowed for this request.",
		HTTPStatusCode: http.StatusForbidden,
	},
	ErrSTSMissingParameter: {
		Code:           "MissingParameter",

        try {
            final MessageDigest md4 = Crypto.getMD4();
            md4.update(Strings.getUNIBytes(tempStr));
            return md4.digest();
        } finally {
            // Clear the temporary string from memory (best effort)
            if (tempStr != null) {
                tempStr.intern();
            }
        }
    }

    /**
     * Generates the NTOWFv1 hash for the given password.

A user or application can now present a token to the `AssumeRoleWithCustomToken` API, and MinIO verifies this token by sending it to the Identity Management Plugin webhook. This plugin responds with some information and MinIO is able to generate temporary STS credentials to interact with object storage.

The authentication flow is similar to that of OpenID, however the token is "opaque" to MinIO - it is simply sent to the plugin for verification. CAVEAT: There is no console UI integration for...

- On finding at least one associated policy, MinIO generates temporary credentials for the user storing the list of groups in a cryptographically secure session token. The temporary access key, secret key and session token are returned to the user.
- The user can now use these credentials to make requests to the MinIO server.

        super.setUp(testInfo);

        // Create a temporary test file
        testFile = File.createTempFile("test_mapping", ".txt");
        testFile.deleteOnExit();
        // Ensure the test file is initially empty
        try (java.io.FileWriter fw = new java.io.FileWriter(testFile)) {
            fw.write("");
        }

        // Create a temporary project.properties file for SystemHelper

    private static final long serialVersionUID = 1L;

    /**
     * Error severity levels
     */
    public enum Severity {
        RECOVERABLE, // Can retry the operation
        TRANSIENT, // Temporary error, retry after delay
        PERMANENT, // Operation cannot succeed
        FATAL // Connection or session must be terminated
    }

    /**
     * Error categories
     */
    public enum Category {

// -----------------------------------------------------------------------------
// APIs specific to Eager modes
// -----------------------------------------------------------------------------

// Temporary APIs till we figure out how to create scalar valued Eager
// tensors and how to get value out of eager abstract tensors.
TF_AbstractTensor* TF_CreateAbstractTensorFromEagerTensor(TFE_TensorHandle* t,

            logger.warn("Failed to upload backup file: fileName={}, error={}", fileName, e.getMessage(), e);
            if (tempFile.exists() && !tempFile.delete()) {
                logger.warn("Failed to delete temporary file: {}", tempFile.getAbsolutePath());
            }
            throwValidationError(messages -> messages.addErrorsFileIsNotSupported(GLOBAL, fileName), this::asListHtml);
        }

        return false;
      case READY:
        return true;
      default:
    }
    return tryToComputeNext();
  }

  private boolean tryToComputeNext() {
    state = State.FAILED; // temporary pessimism
    next = computeNext();
    if (state != State.DONE) {
      state = State.READY;
      return true;
    }
    return false;
  }

```

### Using WebIdentiy API

On another terminal run `web-identity.go` a sample client application which obtains JWT id_tokens from an identity provider, in our case its Keycloak. Uses the returned id_token response to get new temporary credentials from the MinIO server using the STS API call `AssumeRoleWithWebIdentity`.

```