ConditionValues: getSTSConditionValues(r, "", cred),
			Claims:          cred.Claims,
		}) {
			writeSTSErrorResponse(ctx, w, ErrSTSAccessDenied, errors.New("this user does not have enough permission"))
			return
		}
	}

	// Set the newly generated credentials.
	updatedAt, err := globalIAMSys.SetTempUser(ctx, cred.AccessKey, cred, policyName)
	if err != nil {

        * requests for a TLS client certificate for any node are approved if the CSR creator has `create` permission on the `certificatesigningrequests` resource and `nodeclient` subresource in the `certificates.k8s.io` API group
        * requests from a node for a TLS client certificate for itself are approved if the CSR creator has `create` permission on the `certificatesigningrequests` resource and the `selfnodeclient` subresource in the `certificates.k8s.io` API group

the server. We typically separate features from the server because they require
permissions that we don't believe *all* of Elasticsearch should have or because
they depend on libraries that we don't believe *all* of Elasticsearch should
depend on.

For example, reindex requires the `connect` permission so it can perform
reindex-from-remote but we don't believe that the *all* of Elasticsearch should

labels.config_parameter=Config Parameters
labels.max_access_count=Max Access Count
labels.number_of_thread=Number of Threads
labels.interval_time=Interval
labels.millisec=msec
labels.permissions=Permissions
labels.virtual_hosts=Virtual Hosts
labels.virtual_host=Virtual Host
labels.label_type=Label
labels.file_crawling_button_create=Create
labels.file_crawling_button_create_job=Create New Job

	if err != nil {
		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
		return
	}

	// Permission checks:
	//
	// 1. Any type of account (i.e. access keys (previously/still called service
	// accounts), STS accounts, internal IDP accounts, etc) with the
	// policy.UpdateServiceAccountAdminAction permission can update any service
	// account.
	//

* Fix cluster autoscaler addon permissions so it can access batch/job. ([#69858](https://github.com/kubernetes/kubernetes/pull/69858), [@losipiuk](https://github.com/losipiuk))
* change default azure file mount permission to 0777 ([#69854](https://github.com/kubernetes/kubernetes/pull/69854), [@andyzhangx](https://github.com/andyzhangx))

                }

                // Update session information
                if (logger.isDebugEnabled()) {
                    logger.debug("[scheduleParentGroupLookup] Notifying permission change for user: {}", user.getName());
                }
                ComponentUtil.getActivityHelper().permissionChanged(OptionalThing.of(new FessUserBean(user)));
            } catch (final Exception e) {

}

// HeadBucketHandler - HEAD Bucket
// ----------
// This operation is useful to determine if a bucket exists.
// The operation returns a 200 OK if the bucket exists and you
// have permission to access it. Otherwise, the operation might
// return responses such as 404 Not Found and 403 Forbidden.
func (api objectAPIHandlers) HeadBucketHandler(w http.ResponseWriter, r *http.Request) {

- kube-apiserver:

        fessConfig.setSystemProperty("entraid.default.groups", form.entraidDefaultGroups);
        fessConfig.setSystemProperty("entraid.default.roles", form.entraidDefaultRoles);
        fessConfig.setSystemProperty("entraid.permission.fields", form.entraidPermissionFields);
        fessConfig.setSystemProperty("entraid.use.ds", String.valueOf(isCheckboxEnabled(form.entraidUseDs)));

        fessConfig.storeSystemProperties();