assumeRole          = "AssumeRole"

	stsRequestBodyLimit = 10 * (1 << 20) // 10 MiB

	// JWT claim keys
	expClaim = "exp"
	subClaim = "sub"
	audClaim = "aud"
	issClaim = "iss"

	// JWT claim to check the parent user
	parentClaim = "parent"

	// LDAP claim keys
	ldapUser       = "ldapUser"       // this is a key name for a normalized DN value

    
    // Getters and increment methods
}
```

## 12. Future Enhancements

1. **Directory Leases**: Extend lease support for directories
2. **Lease Key Persistence**: Save lease keys for reconnection
3. **Parent-Child Relationships**: Implement hierarchical leases
4. **Lease Sharing**: Support lease sharing across handles

		}
	}
}

// TestExtractSignedHeaders - Tests validate extraction of signed headers using list of signed header keys.
func TestExtractSignedHeaders(t *testing.T) {
	signedHeaders := []string{"host", "x-amz-content-sha256", "x-amz-date", "transfer-encoding"}

            pathToLease.clear();
        } finally {
            lock.writeLock().unlock();
        }
    }

    /**
     * Get all active leases
     *
     * @return map of lease keys to lease entries
     */
    public Map<Smb2LeaseKey, LeaseEntry> getAllLeases() {
        return new ConcurrentHashMap<>(leases);
    }

    /**
     * Clean up expired leases
     *

    public static final int ACB_TRUSTED_FOR_DELEGATION = 8192;
    /** Account control bit flag: Account is not delegated */
    public static final int ACB_NOT_DELEGATED = 16384;
    /** Account control bit flag: Use DES encryption keys only */
    public static final int ACB_USE_DES_KEY_ONLY = 32768;
    /** Account control bit flag: Pre-authentication is not required */
    public static final int ACB_DONT_REQUIRE_PREAUTH = 65536;

    /**

    public static final int ACB_TRUSTED_FOR_DELEGATION = 8192;
    /** Account control bit flag: Account is not delegated */
    public static final int ACB_NOT_DELEGATED = 16384;
    /** Account control bit flag: Use DES encryption keys only */
    public static final int ACB_USE_DES_KEY_ONLY = 32768;
    /** Account control bit flag: Pre-authentication is not required */
    public static final int ACB_DONT_REQUIRE_PREAUTH = 65536;

    /**

  ## Add new service accounts as explained here https://docs.min.io/community/minio-object-store/administration/identity-access-management/minio-user-management.html#access-keys
  # - accessKey: console-svcacct
  #   secretKey: console123
  #   user: console
  ## Or you can refer to specific secret
  # - accessKey: externalSecret
  #   existingSecret: my-secret

const (
	ReservedMetadataPrefix      = "X-Minio-Internal-"
	ReservedMetadataPrefixLower = "x-minio-internal-"
)

// containsReservedMetadata returns true if the http.Header contains
// keys which are treated as metadata but are reserved for internal use
// and must not set by clients
func containsReservedMetadata(header http.Header) bool {
	for key := range header {
		if _, ok := validSSEReplicationHeaders[key]; ok {

PEM encoded files for keys and certificates for the tests or for setting up TLS in a test cluster.
Also, when in FIPS 140 mode, hostname verification for TLS cannot be turned off so if you are using
`*.verification_mode: none` , you'd need to mute the test in fips mode.

When using TLS, ensure that private keys used are longer than 2048 bits, or mute the test in fips mode.

     */
    @Deprecated(since = "4.0.0", forRemoval = true)
    String ID_COMBINATION_MODE_ATTRIBUTE = XmlService.ID_COMBINATION_MODE_ATTRIBUTE;

    /**
     * In case of complex XML structures, combining can be done based on keys.
     * This is a comma separated list of attribute names.
     */
    @Deprecated(since = "4.0.0", forRemoval = true)
    String KEYS_COMBINATION_MODE_ATTRIBUTE = XmlService.KEYS_COMBINATION_MODE_ATTRIBUTE;

    /**