preload_content=True,
                                          )
            if response.status != 200:
                message = "Credential refresh failed, response: %s"
                raise CredentialRetrievalError(
                    provider=method,
                    error_msg=message % response.status,
                )

 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.app.web.base.login;

import org.lastaflute.web.login.credential.UserPasswordCredential;

/**
 * The credential for a local user.
 */
public class LocalUserCredential extends UserPasswordCredential implements FessCredential {
    /**

	"github.com/minio/madmin-go/v3"
	"github.com/minio/minio-go/v7"
	cr "github.com/minio/minio-go/v7/pkg/credentials"
)

var (
	// Minio endpoint (for STS API)
	stsEndpoint string

	// User account credentials
	minioUsername string
	minioPassword string

	// Display credentials flag
	displayCreds bool

	// Credential expiry duration
	expiryDuration time.Duration

	// Bucket to list
	bucketToList string

        }
        return !Constants.NONE.equals(ssoType);
    }

    /**
     * Attempts to obtain login credentials using the configured SSO authenticator.
     *
     * @return The login credential from SSO authentication, or null if SSO is not available
     *         or no credential could be obtained
     */
    public LoginCredential getLoginCredential() {
        if (available()) {

 */
package org.codelibs.fess.app.web.base.login;

import java.util.function.Supplier;

import org.lastaflute.web.login.credential.LoginCredential;
import org.lastaflute.web.response.ActionResponse;

/**
 * The credential for action response.
 */
public class ActionResponseCredential implements LoginCredential {

    private final Supplier<ActionResponse> action;

    /**

        }

    }

    /**
     * Resolves the SPNEGO credential to a user entity.
     *
     * This method handles the resolution of SPNEGO credentials by checking
     * if the user is an admin user or needs to be authenticated through LDAP.
     *
     * @param resolver The credential resolver to use for user lookup
     */
    @Override

                case PacConstants.LOGON_INFO:
                    // PAC Credential Information
                    if (this.logonInfo == null) {
                        this.logonInfo = new PacLogonInfo(bufferData);
                    }
                    break;
                case PacConstants.CREDENTIAL_TYPE:
                    // PAC Credential Type
                    this.credentialType = new PacCredentialType(bufferData);

        // A null byte array should cause a PACDecodingException.
        PACDecodingException exception = assertThrows(PACDecodingException.class, () -> new PacCredentialType(null));
        assertEquals("Invalid PAC credential type", exception.getMessage());
    }

    /**
     * Tests the constructor with a byte array that is too large.
     */
    @Test
    void testConstructorWithDataTooLarge() {

		"s3:GetObject",
		"s3:PutObject"
	  ],
	  "Effect": "Allow",
	  "Resource": ["arn:aws:s3:::mybucket/${aws:username}/*"]
	}
  ]
}
```

If the user is authenticating using an STS credential which was authorized from OpenID connect we allow all `jwt:*` variables specified in the JWT specification, custom `jwt:*` or extensions are not supported. List of policy variables for OpenID based STS.

- `jwt:sub`
- `jwt:iss`

	testCases := []struct {
		inputQueryKey   string
		inputQueryValue string
		expectedResult  bool
	}{
		// Test case - 1.
		// Test case with query key ""X-Amz-Credential" set.
		{"", "", false},
		// Test case - 2.
		{"X-Amz-Credential", "", true},
		// Test case - 3.
		{"X-Amz-Content-Sha256", "", false},
	}

	for i, testCase := range testCases {
		// creating an input HTTP request.