- `Mapper Type` is `User Attribute`
    - `User Attribute` is `policy`
    - `Token Claim Name` is `policy`
    - `Claim JSON Type` is `string`
  - Save

- Open <http://localhost:8080/auth/realms/{your-realm-name}/.well-known/openid-configuration> to verify OpenID discovery document, verify it has `authorization_endpoint` and `jwks_uri`

### Enable Keycloak Admin REST API support

private val TYPE_SUBTYPE = Regex("$TOKEN/$TOKEN")
private val PARAMETER = Regex(";\\s*(?:$TOKEN=(?:$TOKEN|$QUOTED))?")

/**
 * Returns a media type for this string.
 *
 * @throws IllegalArgumentException if this is not a well-formed media type.
 */
internal fun String.commonToMediaType(): MediaType {
  val typeSubtype: MatchResult =
    TYPE_SUBTYPE.matchAtPolyfill(this, 0)
      ?: throw IllegalArgumentException("No subtype found for: \"$this\"")

the treacle from?'

  `You can draw water out of a water-well,' said the Hatter; `so
I should think you could draw treacle out of a treacle-well--eh,
stupid?'

  `But they were IN the well,' Alice said to the Dormouse, not
choosing to notice this last remark.

  `Of course they were', said the Dormouse; `--well in.'

  This answer so confused poor Alice, that she let the Dormouse

```
~ export MINIO_IDENTITY_OPENID_CLAIM_NAME=name
~ export MINIO_IDENTITY_OPENID_CONFIG_URL=http://127.0.0.1:5556/dex/.well-known/openid-configuration
~ minio server ~/test
```

### Run the `web-identity.go`

```
~ go run web-identity.go -cid example-app -csec ZXhhbXBsZS1hcHAtc2VjcmV0 \
     -config-ep http://127.0.0.1:5556/dex/.well-known/openid-configuration \
     -cscopes groups,openid,email,profile
```

```

    /**
     * Returns a media type for this string.
     *
     * @throws IllegalArgumentException if this is not a well-formed media type.
     */
    @JvmStatic
    @JvmName("get")
    fun String.toMediaType(): MediaType = commonToMediaType()

    /** Returns a media type for this, or null if this is not a well-formed media type. */
    @JvmStatic
    @JvmName("parse")

Sie würden dies wahrscheinlich nur einmal tun, beim ersten Mal, wenn Sie alles einrichten.

/// tip | "Tipp"

Dieser Domainnamen-Aspekt liegt weit vor HTTPS, aber da alles von der Domain und der IP-Adresse abhängt, lohnt es sich, das hier zu erwähnen.

///

### DNS

Konzentrieren wir uns nun auf alle tatsächlichen HTTPS-Aspekte.

	}
	return keys, nil
}

// CreateMetadata encodes the sealed object key into the metadata and returns
// the modified metadata. If the keyID and the kmsKey is not empty it encodes
// both into the metadata as well. It allocates a new metadata map if metadata
// is nil.
func (sses3) CreateMetadata(metadata map[string]string, keyID string, kmsKey []byte, sealedKey SealedKey) map[string]string {
	if sealedKey.Algorithm != SealAlgorithm {

                <div class="collapse" id="accept-${changeId}">
                  <div class="well">
                      In order to accept this change add the following to <code>${relativePathToMainApiChanges()}</code>:
                    <pre>${prettyPrintJson(acceptanceJson)}</pre>
                  </div>

Sie verfügt über eine *Pfadoperation*, die einen `Invoice`-Body empfängt, und einen Query-Parameter `callback_url`, der die URL für den Callback enthält.

Dieser Teil ist ziemlich normal, der größte Teil des Codes ist Ihnen wahrscheinlich bereits bekannt:

```Python hl_lines="9-13  36-53"
{!../../docs_src/openapi_callbacks/tutorial001.py!}
```

/// tip | "Tipp"

	return key, err
}

// CreateMetadata encodes the sealed object key into the metadata and returns
// the modified metadata. If the keyID and the kmsKey is not empty it encodes
// both into the metadata as well. It allocates a new metadata map if metadata
// is nil.
func (ssekms) CreateMetadata(metadata map[string]string, keyID string, kmsKey []byte, sealedKey SealedKey, ctx kms.Context) map[string]string {