Configure MinIO for Authentication using Active Directory / LDAP

Access the Operator Console

Temporarily forward traffic between the local host machine and the MinIO Operator Console and retrieve the JWT token for your Operator deployment. For instructions, see Configure access to the Operator Console service.

Open your browser to the temporary URL and enter the JWT Token into the login page. You should see the Tenants page:

To deploy a new MinIO Tenant with AD/LDAP external identity management, select the + Create Tenant button.

To configure an existing MinIO Tenant with AD/LDAP external identity management select that Tenant from the displayed list. The following steps reference the necessary sections and configuration settings for existing Tenants.

Complete the Identity Provider Section

To enable external identity management with an Active Directory / LDAP provider, select the Identity Provider section. You can then change the radio button to Active Directory to display the configuration settings.

An asterisk * marks required fields. The following table provides general guidance for those fields:

Once you complete the section, you can finish any other required sections of Tenant Deployment.

Assign Policies to AD/LDAP Users

MinIO by default assigns no policies to AD/LDAP users or groups. You must explicitly assign MinIO policies to a given user or group Distinguished Name (DN) to grant that user or group access to the MinIO deployment.

The following example assumes an existing alias configured for the MinIO Tenant.

Use the mc idp ldap policy attach command to assign a user or group DN to an existing MinIO Policy:

mc idp ldap policy attach minio-tenant POLICY --user='uid=primary,cn=applications,dc=domain,dc=com'
mc idp ldap policy attach minio-tenant POLICY --group='cn=applications,ou=groups,dc=domain,dc=com'

Replace POLICY with the name of the MinIO policy to assign to the user or group DN.

See Access Control for AD/LDAP-Managed Identities for more information on access control with AD/LDAP users and groups.

Use the MinIO Tenant Console to Log In with AD/LDAP Credential

The MinIO Console supports the full workflow of authenticating to the AD/LDAP provider, generating temporary credentials using the MinIO AssumeRoleWithLDAPIdentity Security Token Service (STS) endpoint, and logging the user into the MinIO deployment.

See Deploy MinIO Tenant: Connect to the Tenant for additonal information about accessing the Tenant Console.

If the AD/LDAP configuration succeeded, the Console displays a button to login with AD/LDAP credentials.

Enter the user’s AD/LDAP credentials and log in to access the Console.

Once logged in, you can perform any action for which the authenticated user is authorized.

You can also create access keys for supporting applications which must perform operations on MinIO. Access Keys are long-lived credentials which inherit their privileges from the parent user. The parent user can further restrict those privileges while creating the access keys.

Generate S3-Compatible Temporary Credentials using AD/LDAP Credentials

Applications can use an AD/LDAP user credential to generate temporary S3-compatible credentials as-needed using the AssumeRoleWithLDAPIdentity Security Token Service (STS) API endpoint. MinIO provides an example Go application ldap.go with an example of managing this workflow.

POST https://minio.example.net?Action=AssumeRoleWithLDAPIdentity
&LDAPUsername=USERNAME
&LDAPPassword=PASSWORD
&Version=2011-06-15
&Policy={}

• Replace minio.example.net with the hostname or URL for the MinIO Tenant service.

• Replace the LDAPUsername with the username of the AD/LDAP user.

• Replace the LDAPPassword with the password of the AD/LDAP user.

• Replace the Policy with an inline URL-encoded JSON policy that further restricts the permissions associated to the temporary credentials.

  Omit to use the policy whose name matches the Distinguished Name (DN) of the AD/LDAP user.

The API response consists of an XML document containing the access key, secret key, session token, and expiration date. Applications can use the access key and secret key to access and perform operations on MinIO.

See the AssumeRoleWithLDAPIdentity for reference documentation.

Set the Active Directory / LDAP Configuration Settings

Configure the AD/LDAP provider using one of the following:

• MinIO Client

• Environment variables

• MinIO Console

All methods require starting/restarting the MinIO deployment to apply changes.

The following tabs provide a quick reference for the available configuration methods:

mc idp ldap add ALIAS                                                   \
   server_addr="ldaps.example.net:636"                                  \
   lookup_bind_dn="CN=xxxxx,OU=xxxxx,OU=xxxxx,DC=example,DC=net"        \
   lookup_bind_password="xxxxxxxx"                                      \
   user_dn_search_base_dn="DC=example,DC=net"                           \
   user_dn_search_filter="(&(objectCategory=user)(sAMAccountName=%s))"  \
   group_search_filter= "(&(objectClass=group)(member=%d))"             \
   group_search_base_dn="ou=MinIO Users,dc=example,dc=net"              \
   enabled="true"                                                       \
   tls_skip_verify="off"                                                \
   server_insecure=off                                                  \
   server_starttls="off"                                                \
   srv_record_name=""                                                   \
   comment="Test LDAP server"

export MINIO_IDENTITY_LDAP_SERVER_ADDR="ldaps.example.net:636"
export MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN="CN=xxxxx,OU=xxxxx,OU=xxxxx,DC=example,DC=net"
export MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN="dc=example,dc=net"
export MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER="(&(objectCategory=user)(sAMAccountName=%s))"
export MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD="xxxxxxxxx"
export MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER="(&(objectClass=group)(member=%d))"
export MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN="ou=MinIO Users,dc=example,dc=net"
export MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY="off"
export MINIO_IDENTITY_LDAP_SERVER_INSECURE="off"
export MINIO_IDENTITY_LDAP_SERVER_STARTTLS="off"
export MINIO_IDENTITY_LDAP_SRV_RECORD_NAME=""
export MINIO_IDENTITY_LDAP_COMMENT="LDAP test server"

Restart the MinIO Deployment

You must restart the MinIO deployment to apply the configuration changes.

If you configured AD/LDAP from the MinIO Console, no additional action is required. The MinIO Console automatically restarts the deployment after saving the new AD/LDAP configuration.

For MinIO Client and environment variable configuration, use the mc admin service restart command to restart the deployment:

mc admin service restart ALIAS

Replace ALIAS with the alias of the deployment to restart.

Use the MinIO Console to Log In with AD/LDAP Credentials

The MinIO Console supports the full workflow of authenticating to the AD/LDAP provider, generating temporary credentials using the MinIO AssumeRoleWithLDAPIdentity Security Token Service (STS) endpoint, and logging the user into the MinIO deployment.

You can access the Console by opening the root URL for the MinIO cluster. For example, https://minio.example.net:9000.

Once logged in, you can perform any action for which the authenticated user is authorized.

You can also create access keys for supporting applications which must perform operations on MinIO. Access Keys are long-lived credentials which inherit their privileges from the parent user. The parent user can further restrict those privileges while creating the service account.

Generate S3-Compatible Temporary Credentials using AD/LDAP Credentials

MinIO requires clients to authenticate using AWS Signature Version 4 protocol with support for the deprecated Signature Version 2 protocol. Specifically, clients must present a valid access key and secret key to access any S3 or MinIO administrative API, such as PUT, GET, and DELETE operations.

Applications can generate temporary access credentials as-needed using the AssumeRoleWithLDAPIdentity Security Token Service (STS) API endpoint and AD/LDAP user credentials. MinIO provides an example Go application ldap.go that manages this workflow.

POST https://minio.example.net?Action=AssumeRoleWithLDAPIdentity
&LDAPUsername=USERNAME
&LDAPPassword=PASSWORD
&Version=2011-06-15
&Policy={}

• Replace the LDAPUsername with the username of the AD/LDAP user.

• Replace the LDAPPassword with the password of the AD/LDAP user.

• Replace the Policy with an inline URL-encoded JSON policy that further restricts the permissions associated to the temporary credentials.

  Omit to use the policy whose name matches the Distinguished Name (DN) of the AD/LDAP user.

The API response consists of an XML document containing the access key, secret key, session token, and expiration date. Applications can use the access key and secret key to access and perform operations on MinIO.

See the AssumeRoleWithLDAPIdentity for reference documentation.