Identity and Access Management Settings

• 1: Active Directory / LDAP Settings
• 2: OpenID Identity Management Settings
• 3: Silo Identity Management Plugin Settings
• 4: Silo Access Management Plugin Settings

1 - Active Directory / LDAP Settings

This page documents settings for enabling external identity management using an Active Directory or LDAP service. See Configure MinIO for Authentication using Active Directory / LDAP for a tutorial on using these settings.

The identity_ldap configuration settings remains available for existing scripts and other tools.

You can establish or modify settings by defining:

• an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
• a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Some settings have only an environment variable or a configuration setting, but not both.

Examples

MINIO_IDENTITY_LDAP_SERVER_ADDR="ldapserver.com:636"

mc admin config set identity_ldap                        \
   enabled="true"                                        \
   server_addr="ad-ldap.example.net/"                    \
   lookup_bind_dn="cn=miniolookupuser,dc=example,dc=net" \
   lookup_bind_dn_password="userpassword"                \
   user_dn_search_base_dn="dc=example,dc=net"            \
   user_dn_search_filter="(&(objectCategory=user)(sAMAccountName=%s))"

Settings

Server Address

Required

ldapserver.com:636

Specify the hostname for the Active Directory / LDAP server. For example:

ldapserver.com:636

Lookup Bind DN

Required

Specify the Distinguished Name (DN) for an AD/LDAP account MinIO uses when querying the AD/LDAP server. Enables Lookup-Bind authentication to the AD/LDAP server.

The DN account should be a read-only access keys with sufficient privileges to support querying performing user and group lookups.

Lookup Bind Password

Required

Specify the password for the Lookup-Bind user account.

User DN Search Base DN

Required

Specify the base Distinguished Name (DN) MinIO uses when querying for user credentials matching those provided by an authenticating client.

Separate multiple DNs with a semicolon (;).

For example:

cn=miniousers,dc=myldapserver,dc=net;ou=swengg,dc=min,dc=io

Supports Lookup-Bind mode.

User DN Search Filter

Required

Specify the AD/LDAP search filter MinIO uses when querying for user credentials matching those provided by an authenticating client.

Use the %s substitution character to insert the client-specified username into the search string. For example:

(userPrincipalName=%s)

User DN Attributes

Optional

Comma-separated list of user DN attributes.

Some valid values include, uid,cn,mail,sshPublicKey.

To enable public authentication for LDAP users, pass sshPublicKey as a DN attribute. The user can then use the passed SSH Public Key to log in to SFTP servers.

mc idp ldap update ALIAS user_dn_attributes=sshPublicKey

Enabled

Optional

Set to false to disable the AD/LDAP configuration.

If false, applications cannot generate STS credentials or otherwise authenticate to MinIO using the configured provider.

Defaults to true or “enabled”.

Group Search Filter

Optional

Specify an AD/LDAP search filter for performing group lookups for the authenticated user

Use the %s substitution character to insert the client-specified username into the search string. Use the %d substitution character to insert the Distinguished Name of the client-specified username into the search string.

For example:

(&(objectclass=groupOfNames)(memberUid=%s))

When providing an AD/LDAP group search filter, configure a filter that returns the minimum number of relevant groups for the purpose of supporting authentication. Filters that return large group assignments increase the size of associated calls and resources. Functions sensitive to large request or response bodies may exhibit unexpected behaviors as a result.

When providing an AD/LDAP group search filter, configure a filter that returns the minimum number of relevant groups for the purpose of supporting authentication. Filters that return large group assignments increase the size of associated calls and resources. Functions sensitive to large request or response bodies may exhibit unexpected behaviors as a result.

Group Search Base DN

Optional

Specify a semicolon-separated (;) list of group search base Distinguished Names MinIO uses when performing group lookups.

For example:

cn=miniogroups,dc=myldapserver,dc=net;ou=swengg,dc=min,dc=io

TLS Skip Verify

Optional

Specify on to trust the AD/LDAP server TLS certificates without verification. This option may be required if the AD/LDAP server TLS certificates are signed by an untrusted Certificate Authority (e.g. self-signed).

Defaults to off

Server Insecure

Optional

Specify on to allow unsecured (non-TLS encrypted) connections to the AD/LDAP server.

MinIO sends AD/LDAP user credentials in plain text to the AD/LDAP server, such that enabling TLS is required to prevent reading credentials over the wire. Using this option presents a security risk where any user with access to network traffic can observe the unencrypted plaintext credentials.

Defaults to off.

Server Start TLS

Optional

Specify on to enable StartTLS connections to an AD/LDAP server.

Defaults to off

For more about StartTLS, refer to section 4.14 of the LDAP RFC 4511 specification.

SRV Record Name

Optional

Specify the appropriate value to enable MinIO to select an AD/LDAP server using a DNS SRV record request.

When enabled, MinIO selects an AD/LDAP server by:

• Constructing the target SRV record name following standard naming conventions.
• Requesting a list of available AD/LDAP servers.
• Choosing an appropriate target based on priority and weight.

The configuration examples below presume the AD/LDAP server address is set to example.com and the SRV record protocol is _tcp.

For SRV record names beginning with _ldap, specify ldap. The constructed DNS SRV record name resembles the following:

_ldap._tcp.example.com

For SRV record names with beginning with _ldaps, specify ldaps. The constructed DNS SRV record name resembles the following:

_ldaps._tcp.example.com

If your DNS SRV record name uses alternate service or protocol names, specify on and provide the full record name as your LDAP server address. Example: _ldapserver._specialtcp.example.com

For more about DNS SRV records, see DNS SRV Records for LDAP.

Comment

Optional

Specify a comment to associate to the AD/LDAP configuration.

2 - OpenID Identity Management Settings

This page documents settings for enabling external identity management using an OpenID Connect (OIDC)-compatible provider. See OpenID Connect Access Management for a tutorial on using these settings.

You can establish or modify settings by defining:

• an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
• a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Some settings have only an environment variable or a configuration setting, but not both.

Examples

MINIO_IDENTITY_OPENID_CONFIG_URL="https://openid-provider.example.net/.well-known/openid-configuration"

mc admin config set identity_openid                                               \
  config_url="https://openid-provider.example.net/.well-known/openid-configuration" \
  [ARGUMENT="VALUE"] ...

Settings

Config URL

Required

Specify the URL for the OIDC compatible provider discovery document.

The OIDC Discovery URL typically resembles the following:

https://openid-provider.example.net/.well-known/openid-configuration

Enabled

Optional

Set to false to disable the OpenID configuration.

Applications cannot generate STS credentials or otherwise authenticate to MinIO using the configured provider if set to false.

Defaults to true or “enabled”.

Client ID

Optional

Specify the unique public identifier MinIO uses when authenticating user credentials against the OIDC compatible provider.

Client Secret

Optional

Specify the client secret MinIO uses when authenticating user credentials against the OIDC compatible provider. This field may be optional depending on the provider.

Role Policy

Optional

This setting is mutually exclusive with the Claim Name setting.

Specify a comma-separated list of policy names to use for the request’s RoleArn for all authentication requests for the provider. The specified policy or policies must already exist on the MinIO Server.

To use this OIDC configuration, you must specify the corresponding RoleArn in the STS request body.

Claim Name

Optional

This setting is mutually exclusive with the Role Policy setting.

Specify the name of the JWT Claim MinIO uses to identify the policies to attach to the authenticated user.

The claim can contain one or more comma-separated policy names to attach to the user. The claim must contain at least one policy for the user to have any permissions on the MinIO server.

Defaults to policy.

Claim Prefix

Optional

This setting is deprecated and has been removed as of RELEASE.2024-07-13T01-46-15Z. Use MINIO_IDENTITY_OPENID_CLAIM_NAME instead.

Specify the JWT Claim namespace prefix to apply to the specified claim name.

Display Name

Optional

Specify the user-facing name the MinIO Console displays on the login screen.

Scopes

Optional

Specify a comma-separated list of scopes. Defaults to those scopes advertised in the discovery document.

Redirect URI

Optional

This setting is deprecated and has been removed as of RELEASE.2024-07-13T01-46-15Z. Use MINIO_BROWSER_REDIRECT_URL instead.

The MinIO Console defaults to using the hostname of the node making the authentication request. For MinIO deployments behind a load balancer or reverse proxy, specify this field to ensure the OIDC provider returns the authentication response to the correct MinIO Console URL. Include the Console hostname, port, and /oauth_callback:

http://minio.example.net:consoleport/oauth_callback

Ensure you start the MinIO Server with the --console-address option to set a static Console listen port. The default behavior with that option omitted is to select a random port number at startup.

The specified URI must match one of the approved redirect / callback URIs on the provider. See the OpenID Authentication Request for more information.

Dynamic URI Redirect

Optional

The MinIO Console defaults to using the hostname of the node making the authentication request as part of the redirect URI provided to the OIDC provider. For MinIO deployments behind a load balancer using a round-robin protocol, this may result in the load balancer returning the response to a different MinIO Node than the originating client.

Specify this option as on to direct the MinIO Console to use the Host header of the originating request to construct the redirect URI passed to the OIDC provider. Defaults to off.

User Info

Optional

Allow MinIO to fetch claims from the UserInfo Endpoint for the authenticated user.

Valid values are on or off.

Vendor

Optional

Specify the OIDC Vendor to enable specific supported behaviors for that vendor.

Supports the following value:

• keycloak

Keycloak Realm

Optional

This setting requires that the OpenID Vendor setting be defined as keycloak.

Specify the Keycloak Realm to use as part of Keycloak Admin API Operations, such as main.

Keycloak Admin URL

Optional

This setting requires that the OpenID Vendor setting be defined as keycloak.

Specify the Keycloak Admin API URL. MinIO can use this URL if configured to periodically validate authenticated Keycloak users as active/existing. For example, https://keycloak-endpoint:port/admin/.

Comment

Optional

Specify a comment to associate with the OIDC compatible provider configuration.

3 - Silo Identity Management Plugin Settings

This page documents settings for enabling external identity management using the MinIO Identity Management Plugin. See MinIO External Identity Management Plugin for a tutorial on using these settings.

You can establish or modify settings by defining:

• an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
• a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Some settings have only an environment variable or a configuration setting, but not both.

Examples

When setting up the MinIO Identity Management Plugin, you must define at a minimum all of the required settings. The examples here represent the minimum required settings.

MINIO_IDENTITY_PLUGIN_URL="https://authservice.example.net:8080/auth"
MINIO_IDENTITY_PLUGIN_ROLE_POLICY="ConsoleUser"

mc admin config set identity_plugin                  \
   url="https://external-auth.example.net:8080/auth" \
   role_policy="consoleAdmin"                        \
   [ARGUMENT=VALUE] ...

Settings

URL

Required

The webhook endpoint for the external identity management service (https://authservice.example.net:8080/auth).

Role Policy

Required

Specify a comma-separated list of MinIO policies to assign to authenticated users.

Enable

Optional

Set to false to disable the identity provider configuration.

Applications cannot generate STS credentials or otherwise authenticate to MinIO using the configured provider if set to false.

Defaults to true or “enabled”.

Token

Optional

An authentication token to present to the configured webhook endpoint.

Specify a supported HTTP Authentication scheme as a string value, such as "Bearer TOKEN". MinIO sends the token using the HTTP Authorization header.

Role ID

Optional

Specify a unique ID MinIO uses to generate an ARN for this identity manager. MinIO automatically adds an idmp- prefix to the specified ID when generating the ARN.

If omitted, MinIO automatically generates the ID and prints the full ARN to the server log.

Comment

Optional

Specify a comment to associate to the identity configuration.

4 - Silo Access Management Plugin Settings

This page documents settings for enabling external authorization management using the MinIO Access Management Plugin. See MinIO External Access Management Plugin for a tutorial on using these settings.

You can establish or modify settings by defining:

• an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
• a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Some settings have only an environment variable or a configuration setting, but not both.

Examples

When setting up the MinIO Access Management plugin, you must define at minimum all required settings. The examples here represent the minimum required setting.

MINIO_POLICY_PLUGIN_URL="https://authzservice.example.net:8080/authz"

mc admin config set policy_plugin                     \
   url="https://authzservice.example.net:8080/authz"  \
   [ARGUMENT=VALUE] ...

Settings

URL

Required

The webhook endpoint for the external access management service (https://authzservice.example.net:8080/authz).

Auth Token

Optional

An authentication token to present to the configured webhook endpoint.

Specify a supported HTTP Authentication scheme as a string value, such as "Bearer TOKEN". MinIO sends the token using the HTTP Authorization header.

HTTP2

Optional

Enable experimental HTTP2 support for connecting to the configure webhook service.

Defaults to off

Comment

Optional

Specify a comment to associate to the external access management configuration.