support ldap:username for policy substitution (#12390)

LDAPusername is the simpler form of LDAPUser (userDN),
using a simpler version is convenient from policy
conditions point of view, since these are unique id's
used for LDAP login.

cmd/bucket-policy.go

@@ -174,6 +174,8 @@ func getConditionValues(r *http.Request, lc string, username string, claims map[
 			// Special case for AD/LDAP STS users
 			if k == ldapUser {
 				args["user"] = []string{vStr}
+			} else if k == ldapUsername {
+				args["username"] = []string{vStr}
 			} else {
 				args[k] = []string{vStr}
 			}