```

### Using WebIdentiy API

On another terminal run `web-identity.go` a sample client application which obtains JWT id_tokens from an identity provider, in our case its Keycloak. Uses the returned id_token response to get new temporary credentials from the MinIO server using the STS API call `AssumeRoleWithWebIdentity`.

```

    private static final long serialVersionUID = 1L;

    /**
     * Error severity levels
     */
    public enum Severity {
        RECOVERABLE, // Can retry the operation
        TRANSIENT, // Temporary error, retry after delay
        PERMANENT, // Operation cannot succeed
        FATAL // Connection or session must be terminated
    }

    /**
     * Error categories
     */
    public enum Category {

		return nil, errNoSuchUser
	}

	if globalSFTPTrustedCAPubkey != nil && pass == nil {
		err := validateClientKeyIsTrusted(c, key)
		if err != nil {
			return nil, errAuthentication
		}
	} else {
		// Temporary credentials are not allowed.
		if ui.Credentials.IsTemp() {
			return nil, errAuthentication
		}
		if subtle.ConstantTimeCompare([]byte(ui.Credentials.SecretKey), pass) != 1 {
			return nil, errAuthentication
		}

		return 0, err
	}

	// Done once per make.bash.
	if err := adbCopyGoroot(); err != nil {
		return 0, err
	}

	// Prepare a temporary directory that will be cleaned up at the end.
	// Binary names can conflict.
	// E.g. template.test from the {html,text}/template packages.
	binName := filepath.Base(os.Args[1])

public class RepositoryLeakageTest extends AbstractMavenProjectTestCase {

    @Test
    @SuppressWarnings("checkstyle:MethodLength")
    public void testRepositoryLeakageBetweenSiblings() throws Exception {
        // Create a temporary directory structure for our test
        Path tempDir = Files.createTempDirectory("maven-repo-leakage-test");

        try {
            // Create parent POM
            Path parentPom = tempDir.resolve("pom.xml");

				return
			}

			// We might land at .metacache, .trash, .multipart
			// no need to heal them skip, only when bucket
			// is '.minio.sys'
			if u.Bucket == minioMetaBucket {
				// No MRF needed for temporary objects
				if wildcard.Match("buckets/*/.metacache/*", u.Object) {
					continue
				}
				if wildcard.Match("tmp/*", u.Object) {
					continue
				}
				if wildcard.Match("multipart/*", u.Object) {

 * </p>
 * <ul>
 *   <li>Output encoding</li>
 *   <li>Maximum compression ratio and uncompression size</li>
 *   <li>Initial buffer size</li>
 *   <li>Memory size for temporary file storage</li>
 *   <li>Maximum term sizes for alphanumeric and symbolic terms</li>
 *   <li>Custom Tika configuration</li>
 *   <li>Tesseract OCR configuration for image-based documents</li>

			if nerr.Err != nil {
				logger.GetReqInfo(ctx).SetTags("peerAddress", nerr.Host.String())
				iamLogIf(ctx, nerr.Err)
			}
		}
	}
}

// SetTempUser - set temporary user credentials, these credentials have an
// expiry. The permissions for these STS credentials is determined in one of the
// following ways:
//

    // extended file attribute encoding(others same as above)
    /** Compressed file attribute */
    int ATTR_COMPRESSED = 0x800;
    /** Normal file attribute */
    int ATTR_NORMAL = 0x080;
    /** Temporary file attribute */
    int ATTR_TEMPORARY = 0x100;

    // access mask encoding
    /** File read data access right */
    int FILE_READ_DATA = 0x00000001; // 1
    /** File write data access right */

- `aws:username` - This is a string containing the friendly name of the current user, this value would point to STS temporary credential in `AssumeRole`ed requests, use `jwt:preferred_username` in case of OpenID connect and `ldap:username` in case of AD/LDAP. *aws:userid* is an alias to *aws:username* in MinIO.