mirror of
https://github.com/minio/minio.git
synced 2025-11-07 21:02:58 -05:00
cleanup markdown docs across multiple files (#14296)
enable markdown-linter
This commit is contained in:
Harshavardhana
GitHub
@@ -1,4 +1,5 @@
|
||||
# MinIO STS Quickstart Guide [](https://slack.min.io)
|
||||
|
||||
The MinIO Security Token Service (STS) is an endpoint service that enables clients to request temporary credentials for MinIO resources. Temporary credentials work almost identically to default admin credentials, with some differences:
|
||||
|
||||
- Temporary credentials are short-term, as the name implies. They can be configured to last for anywhere from a few minutes to several hours. After the credentials expire, MinIO no longer recognizes them or allows any kind of access from API requests made with them.
|
||||
@@ -11,6 +12,7 @@ Following are advantages for using temporary credentials:
|
||||
- Temporary credentials have a limited lifetime, there is no need to rotate them or explicitly revoke them. Expired temporary credentials cannot be reused.
|
||||
|
||||
## Identity Federation
|
||||
|
||||
| AuthN | Description |
|
||||
| :---------------------- | ------------------------------------------ |
|
||||
| [**WebIdentity**](https://github.com/minio/minio/blob/master/docs/sts/web-identity.md) | Let users request temporary credentials using any OpenID(OIDC) compatible web identity providers such as KeyCloak, Dex, Facebook, Google etc. |
|
||||
@@ -18,8 +20,10 @@ Following are advantages for using temporary credentials:
|
||||
| [**AssumeRole**](https://github.com/minio/minio/blob/master/docs/sts/assume-role.md) | Let MinIO users request temporary credentials using user access and secret keys. |
|
||||
|
||||
### Understanding JWT Claims
|
||||
|
||||
> NOTE: JWT claims are only meant for WebIdentity and ClientGrants.
|
||||
> AssumeRole or LDAP users can skip the entire portion and directly visit one of the links below.
|
||||
>
|
||||
> - [**AssumeRole**](https://github.com/minio/minio/blob/master/docs/sts/assume-role.md)
|
||||
> - [**AD/LDAP**](https://github.com/minio/minio/blob/master/docs/sts/ldap.md)
|
||||
|
||||
@@ -30,18 +34,22 @@ The id_token received is a signed JSON Web Token (JWT). Use a JWT decoder to dec
|
||||
| policy | _string_ or _[]string_ or _comma_separated_value_ | Canned policy name to be applied for STS credentials. (Mandatory) - This can be configured to any desired value such as `roles` or `groups` by setting the environment variable `MINIO_IDENTITY_OPENID_CLAIM_NAME` |
|
||||
|
||||
## Get started
|
||||
|
||||
In this document we will explain in detail on how to configure all the prerequisites.
|
||||
|
||||
> NOTE: If you are interested in AssumeRole API only, skip to [here](https://github.com/minio/minio/blob/master/docs/sts/assume-role.md)
|
||||
|
||||
### Prerequisites
|
||||
|
||||
- [Configuring keycloak](https://github.com/minio/minio/blob/master/docs/sts/keycloak.md) or [Configuring Casdoor](https://github.com/minio/minio/blob/master/docs/sts/casdoor.md)
|
||||
- [Configuring etcd (optional needed only in gateway or federation mode)](https://github.com/minio/minio/blob/master/docs/sts/etcd.md)
|
||||
|
||||
### Setup MinIO with Identity Provider
|
||||
|
||||
Make sure we have followed the previous step and configured each software independently, once done we can now proceed to use MinIO STS API and MinIO server to use these credentials to perform object API operations.
|
||||
|
||||
#### KeyCloak
|
||||
|
||||
```
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
@@ -51,6 +59,7 @@ minio server /mnt/data
|
||||
```
|
||||
|
||||
#### Casdoor
|
||||
|
||||
```
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
@@ -60,6 +69,7 @@ minio server /mnt/data
|
||||
```
|
||||
|
||||
### Setup MinIO Gateway with Keycloak and Etcd
|
||||
|
||||
Make sure we have followed the previous step and configured each software independently, once done we can now proceed to use MinIO STS API and MinIO gateway to use these credentials to perform object API operations.
|
||||
|
||||
> NOTE: MinIO gateway requires etcd to be configured to use STS API.
|
||||
@@ -74,6 +84,7 @@ minio gateway s3
|
||||
```
|
||||
|
||||
### Using WebIdentiy API
|
||||
|
||||
On another terminal run `web-identity.go` a sample client application which obtains JWT id_tokens from an identity provider, in our case its Keycloak. Uses the returned id_token response to get new temporary credentials from the MinIO server using the STS API call `AssumeRoleWithWebIdentity`.
|
||||
|
||||
```
|
||||
@@ -103,11 +114,12 @@ These credentials can now be used to perform MinIO API operations.
|
||||
|
||||
### Using MinIO Console
|
||||
|
||||
- Open MinIO URL on the browser, lets say http://localhost:9000/
|
||||
- Open MinIO URL on the browser, lets say <http://localhost:9000/>
|
||||
- Click on `Login with SSO`
|
||||
- User will be redirected to the Keycloak user login page, upon successful login the user will be redirected to MinIO page and logged in automatically,
|
||||
the user should see now the buckets and objects they have access to.
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO Admin Complete Guide](https://docs.min.io/docs/minio-admin-complete-guide.html)
|
||||
- [The MinIO documentation website](https://docs.min.io)
|
||||
|
||||
@@ -10,7 +10,9 @@ Returns a set of temporary security credentials that you can use to access MinIO
|
||||
The temporary security credentials returned by this API consists of an access key, a secret key, and a security token. Applications can use these temporary security credentials to sign calls to MinIO API operations. The policy applied to these temporary credentials is inherited from the MinIO user credentials. By default, the temporary security credentials created by AssumeRole last for one hour. However, use the optional DurationSeconds parameter to specify the duration of the credentials. This value varies from 900 seconds (15 minutes) up to the maximum session duration of 365 days.
|
||||
|
||||
## API Request Parameters
|
||||
|
||||
### Version
|
||||
|
||||
Indicates STS API version information, the only supported value is '2011-06-15'. This value is borrowed from AWS STS API documentation for compatibility reasons.
|
||||
|
||||
| Params | Value |
|
||||
@@ -19,9 +21,11 @@ Indicates STS API version information, the only supported value is '2011-06-15'.
|
||||
| *Required* | *Yes* |
|
||||
|
||||
### AUTHPARAMS
|
||||
|
||||
Indicates STS API Authorization information. If you are familiar with AWS Signature V4 Authorization header, this STS API supports signature V4 authorization as mentioned [here](https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html)
|
||||
|
||||
### DurationSeconds
|
||||
|
||||
The duration, in seconds. The value can range from 900 seconds (15 minutes) up to 365 days. If value is higher than this setting, then operation fails. By default, the value is set to 3600 seconds.
|
||||
|
||||
| Params | Value |
|
||||
@@ -31,6 +35,7 @@ The duration, in seconds. The value can range from 900 seconds (15 minutes) up t
|
||||
| *Required* | *No* |
|
||||
|
||||
### Policy
|
||||
|
||||
An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this operation returns new temporary credentials. The resulting session's permissions are the intersection of the canned policy name and the policy set here. You cannot use this policy to grant more permissions than those allowed by the canned policy name being assumed.
|
||||
|
||||
| Params | Value |
|
||||
@@ -40,17 +45,21 @@ An IAM policy in JSON format that you want to use as an inline session policy. T
|
||||
| *Required* | *No* |
|
||||
|
||||
### Response Elements
|
||||
|
||||
XML response for this API is similar to [AWS STS AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html#API_AssumeRole_ResponseElements)
|
||||
|
||||
### Errors
|
||||
|
||||
XML error response for this API is similar to [AWS STS AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html#API_AssumeRole_Errors)
|
||||
|
||||
## Sample `POST` Request
|
||||
|
||||
```
|
||||
http://minio:9000/?Action=AssumeRole&DurationSeconds=3600&Version=2011-06-15&Policy={"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::*"}]}&AUTHPARAMS
|
||||
```
|
||||
|
||||
## Sample Response
|
||||
|
||||
```
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<AssumeRoleResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
|
||||
@@ -73,15 +82,17 @@ http://minio:9000/?Action=AssumeRole&DurationSeconds=3600&Version=2011-06-15&Pol
|
||||
```
|
||||
|
||||
## Using AssumeRole API
|
||||
|
||||
```
|
||||
$ export MINIO_ROOT_USER=minio
|
||||
$ export MINIO_ROOT_PASSWORD=minio123
|
||||
$ minio server ~/test
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
minio server ~/test
|
||||
```
|
||||
|
||||
Create new users following the multi-user guide [here](https://docs.min.io/docs/minio-multi-user-quickstart-guide.html)
|
||||
|
||||
### Testing an example with awscli tool
|
||||
|
||||
> Use the same username and password created in the previous steps.
|
||||
|
||||
```
|
||||
@@ -112,7 +123,6 @@ $ aws --profile foobar --endpoint-url http://localhost:9000 sts assume-role --po
|
||||
|
||||
The included program in this directory can also be used for testing:
|
||||
|
||||
|
||||
``` shell
|
||||
$ go run assume-role.go -u foobar -p foo12345 -d
|
||||
Only displaying credentials:
|
||||
@@ -123,5 +133,6 @@ SessionToken: eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiIyN1lEUllFT
|
||||
```
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO Admin Complete Guide](https://docs.min.io/docs/minio-admin-complete-guide.html)
|
||||
- [The MinIO documentation website](https://docs.min.io)
|
||||
|
||||
@@ -5,9 +5,10 @@ Casdoor is a UI-first centralized authentication / Single-Sign-On (SSO) platform
|
||||
## Prerequisites
|
||||
|
||||
Configure and install casdoor server by following [Casdoor Server Installation](https://casdoor.org/docs/basic/server-installation).
|
||||
For a quick installation, docker-compose reference configs are also available on the [Casdoor Try with Docker](https://casdoor.org/docs/basic/try-with-docker).
|
||||
For a quick installation, docker-compose reference configs are also available on the [Casdoor Try with Docker](https://casdoor.org/docs/basic/try-with-docker).
|
||||
|
||||
### Configure Casdoor
|
||||
|
||||
- Go to Applications
|
||||
- Create or use an existing Casdoor application
|
||||
- Edit the application
|
||||
@@ -23,13 +24,15 @@ For a quick installation, docker-compose reference configs are also available on
|
||||
- Open your favorite browser and visit: **http://`CASDOOR_ENDPOINT`/.well-known/openid-configuration**, you will see the OIDC configure of Casdoor.
|
||||
|
||||
### Configure MinIO
|
||||
|
||||
```
|
||||
$ export MINIO_ROOT_USER=minio
|
||||
$ export MINIO_ROOT_PASSWORD=minio123
|
||||
$ minio server /mnt/export
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
minio server /mnt/export
|
||||
```
|
||||
|
||||
Here are all the available options to configure OpenID connect
|
||||
|
||||
```
|
||||
mc admin config set myminio/ identity_openid
|
||||
|
||||
@@ -46,6 +49,7 @@ comment (sentence) optionally add a comment to this setting
|
||||
```
|
||||
|
||||
and ENV based options
|
||||
|
||||
```
|
||||
mc admin config set myminio/ identity_openid --env
|
||||
|
||||
@@ -62,17 +66,21 @@ MINIO_IDENTITY_OPENID_COMMENT (sentence) optionally add a comment to this
|
||||
```
|
||||
|
||||
Set `identity_openid` config with `config_url`, `client_id` and restart MinIO
|
||||
|
||||
```
|
||||
~ mc admin config set myminio identity_openid config_url="http://CASDOOR_ENDPOINT/.well-known/openid-configuration" client_id=<client id> client_secret=<client secret> claim_name="tag"
|
||||
```
|
||||
|
||||
> NOTE: As MinIO needs to use a claim attribute in JWT for its policy, you should configure it in casdoor as well. Currently, casdoor uses `tag` as a workaround for configuring MinIO's policy.
|
||||
|
||||
Once successfully set restart the MinIO instance.
|
||||
|
||||
```
|
||||
mc admin service restart myminio
|
||||
```
|
||||
|
||||
### Using WebIdentiy API
|
||||
|
||||
On another terminal run `web-identity.go` a sample client application which obtains JWT id_tokens from an identity provider, in our case its Keycloak. Uses the returned id_token response to get new temporary credentials from the MinIO server using the STS API call `AssumeRoleWithWebIdentity`.
|
||||
|
||||
```
|
||||
@@ -96,7 +104,7 @@ This will open the login page of Casdoor, upon successful login, STS credentials
|
||||
|
||||
### Using MinIO Console
|
||||
|
||||
- Open MinIO URL on the browser, lets say http://localhost:9000/
|
||||
- Open MinIO URL on the browser, lets say <http://localhost:9000/>
|
||||
- Click on `Login with SSO`
|
||||
- User will be redirected to the Casdoor user login page, upon successful login the user will be redirected to MinIO page and logged in automatically,
|
||||
the user should see now the buckets and objects they have access to.
|
||||
|
||||
@@ -9,7 +9,9 @@ Calling AssumeRoleWithClientGrants does not require the use of MinIO default cre
|
||||
By default, the temporary security credentials created by AssumeRoleWithClientGrants last for one hour. However, use the optional DurationSeconds parameter to specify the duration of the credentials. This value varies from 900 seconds (15 minutes) up to the maximum session duration of 365 days.
|
||||
|
||||
## API Request Parameters
|
||||
|
||||
### Token
|
||||
|
||||
The OAuth 2.0 access token that is provided by the identity provider. Application must get this token by authenticating the application using client credential grants before the application makes an AssumeRoleWithClientGrants call.
|
||||
|
||||
| Params | Value |
|
||||
@@ -19,6 +21,7 @@ The OAuth 2.0 access token that is provided by the identity provider. Applicatio
|
||||
| *Required* | *Yes* |
|
||||
|
||||
### Version
|
||||
|
||||
Indicates STS API version information, the only supported value is '2011-06-15'. This value is borrowed from AWS STS API documentation for compatibility reasons.
|
||||
|
||||
| Params | Value |
|
||||
@@ -27,6 +30,7 @@ Indicates STS API version information, the only supported value is '2011-06-15'.
|
||||
| *Required* | *Yes* |
|
||||
|
||||
### DurationSeconds
|
||||
|
||||
The duration, in seconds. The value can range from 900 seconds (15 minutes) up to 365 days. If value is higher than this setting, then operation fails. By default, the value is set to 3600 seconds. If no *DurationSeconds* is specified expiry seconds is obtained from *Token*.
|
||||
|
||||
| Params | Value |
|
||||
@@ -36,6 +40,7 @@ The duration, in seconds. The value can range from 900 seconds (15 minutes) up t
|
||||
| *Required* | *No* |
|
||||
|
||||
### Policy
|
||||
|
||||
An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this operation returns new temporary credentials. The resulting session's permissions are the intersection of the canned policy name and the policy set here. You cannot use this policy to grant more permissions than those allowed by the canned policy name being assumed.
|
||||
|
||||
| Params | Value |
|
||||
@@ -45,17 +50,21 @@ An IAM policy in JSON format that you want to use as an inline session policy. T
|
||||
| *Required* | *No* |
|
||||
|
||||
### Response Elements
|
||||
|
||||
XML response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_ResponseElements)
|
||||
|
||||
### Errors
|
||||
|
||||
XML error response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_Errors)
|
||||
|
||||
## Sample `POST` Request
|
||||
|
||||
```
|
||||
http://minio.cluster:9000?Action=AssumeRoleWithClientGrants&DurationSeconds=3600&Token=eyJ4NXQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJraWQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiYXpwIjoiUG9FZ1hQNnVWTzQ1SXNFTlJuZ0RYajVBdTVZYSIsImlzcyI6Imh0dHBzOlwvXC9sb2NhbGhvc3Q6OTQ0M1wvb2F1dGgyXC90b2tlbiIsImV4cCI6MTU0MTgwOTU4MiwiaWF0IjoxNTQxODA1OTgyLCJqdGkiOiI2Y2YyMGIwZS1lNGZmLTQzZmQtYTdiYS1kYTc3YTE3YzM2MzYifQ.Jm29jPliRvrK6Os34nSK3rhzIYLFjE__zdVGNng3uGKXGKzP3We_i6NPnhA0szJXMOKglXzUF1UgSz8MctbaxFS8XDusQPVe4LkB_45hwBm6TmBxzui911nt-1RbBLN_jZIlvl2lPrbTUH5hSn9kEkph6seWanTNQpz9tNEoVa6R_OX3kpJqxe8tLQUWw453A1JTwFNhdHa6-f1K8_Q_eEZ_4gOYINQ9t_fhTibdbkXZkJQFLop-Jwoybi9s4nwQU_dATocgcufq5eCeNItQeleT-23lGxIz0X7CiJrJynYLdd-ER0F77SumqEb5iCxhxuf4H7dovwd1kAmyKzLxpw&Version=2011-06-15
|
||||
```
|
||||
|
||||
## Sample Response
|
||||
|
||||
```
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<AssumeRoleWithClientGrantsResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
|
||||
@@ -76,6 +85,7 @@ http://minio.cluster:9000?Action=AssumeRoleWithClientGrants&DurationSeconds=3600
|
||||
```
|
||||
|
||||
## Using ClientGrants API
|
||||
|
||||
```
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
@@ -92,13 +102,14 @@ $ go run client-grants.go -cid PoEgXP6uVO45IsENRngDXj5Au5Ya -csec eKsw6z8CtOJVBt
|
||||
|
||||
##### Credentials
|
||||
{
|
||||
"accessKey": "NUIBORZYTV2HG2BMRSXR",
|
||||
"secretKey": "qQlP5O7CFPc5m5IXf1vYhuVTFj7BRVJqh0FqZ86S",
|
||||
"expiration": "2018-08-21T17:10:29-07:00",
|
||||
"sessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJOVUlCT1JaWVRWMkhHMkJNUlNYUiIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTM0ODk2NjI5LCJpYXQiOjE1MzQ4OTMwMjksImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiNjY2OTZjZTctN2U1Ny00ZjU5LWI0MWQtM2E1YTMzZGZiNjA4In0.eJONnVaSVHypiXKEARSMnSKgr-2mlC2Sr4fEGJitLcJF_at3LeNdTHv0_oHsv6ZZA3zueVGgFlVXMlREgr9LXA"
|
||||
"accessKey": "NUIBORZYTV2HG2BMRSXR",
|
||||
"secretKey": "qQlP5O7CFPc5m5IXf1vYhuVTFj7BRVJqh0FqZ86S",
|
||||
"expiration": "2018-08-21T17:10:29-07:00",
|
||||
"sessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJOVUlCT1JaWVRWMkhHMkJNUlNYUiIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTM0ODk2NjI5LCJpYXQiOjE1MzQ4OTMwMjksImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiNjY2OTZjZTctN2U1Ny00ZjU5LWI0MWQtM2E1YTMzZGZiNjA4In0.eJONnVaSVHypiXKEARSMnSKgr-2mlC2Sr4fEGJitLcJF_at3LeNdTHv0_oHsv6ZZA3zueVGgFlVXMlREgr9LXA"
|
||||
}
|
||||
```
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO Admin Complete Guide](https://docs.min.io/docs/minio-admin-complete-guide.html)
|
||||
- [The MinIO documentation website](https://docs.min.io)
|
||||
|
||||
@@ -23,6 +23,7 @@ time="2020-07-12T20:45:50Z" level=info msg="listening (http) on 0.0.0.0:5556"
|
||||
```
|
||||
|
||||
### Configure MinIO server with Dex
|
||||
|
||||
```
|
||||
~ export MINIO_IDENTITY_OPENID_CLAIM_NAME=name
|
||||
~ export MINIO_IDENTITY_OPENID_CONFIG_URL=http://127.0.0.1:5556/dex/.well-known/openid-configuration
|
||||
@@ -42,6 +43,7 @@ time="2020-07-12T20:45:50Z" level=info msg="listening (http) on 0.0.0.0:5556"
|
||||
```
|
||||
|
||||
Contents of `allaccess.json`
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
@@ -59,7 +61,8 @@ Contents of `allaccess.json`
|
||||
}
|
||||
```
|
||||
|
||||
### Visit http://localhost:8080
|
||||
### Visit <http://localhost:8080>
|
||||
|
||||
You will be redirected to dex login screen - click "Login with email", enter username password
|
||||
> username: admin@example.com
|
||||
> password: password
|
||||
@@ -67,25 +70,27 @@ You will be redirected to dex login screen - click "Login with email", enter use
|
||||
and then click "Grant access"
|
||||
|
||||
On the browser now you shall see the list of buckets output, along with your temporary credentials obtained from MinIO.
|
||||
|
||||
```
|
||||
{
|
||||
"buckets": [
|
||||
"dl.minio.equipment",
|
||||
"dl.minio.service-fulfillment",
|
||||
"testbucket"
|
||||
],
|
||||
"credentials": {
|
||||
"AccessKeyID": "Q31CVS1PSCJ4OTK2YVEM",
|
||||
"SecretAccessKey": "rmDEOKARqKYmEyjWGhmhLpzcncyu7Jf8aZ9bjDic",
|
||||
"SessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJRMzFDVlMxUFNDSjRPVEsyWVZFTSIsImF0X2hhc2giOiI4amItZFE2OXRtZEVueUZaMUttNWhnIiwiYXVkIjoiZXhhbXBsZS1hcHAiLCJlbWFpbCI6ImFkbWluQGV4YW1wbGUuY29tIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsImV4cCI6IjE1OTQ2MDAxODIiLCJpYXQiOjE1OTQ1ODkzODQsImlzcyI6Imh0dHA6Ly8xMjcuMC4wLjE6NTU1Ni9kZXgiLCJuYW1lIjoiYWRtaW4iLCJzdWIiOiJDaVF3T0dFNE5qZzBZaTFrWWpnNExUUmlOek10T1RCaE9TMHpZMlF4TmpZeFpqVTBOallTQld4dlkyRnMifQ.nrbzIJz99Om7TvJ04jnSTmhvlM7aR9hMM1Aqjp2ONJ1UKYCvegBLrTu6cYR968_OpmnAGJ8vkd7sIjUjtR4zbw",
|
||||
"SignerType": 1
|
||||
}
|
||||
"buckets": [
|
||||
"dl.minio.equipment",
|
||||
"dl.minio.service-fulfillment",
|
||||
"testbucket"
|
||||
],
|
||||
"credentials": {
|
||||
"AccessKeyID": "Q31CVS1PSCJ4OTK2YVEM",
|
||||
"SecretAccessKey": "rmDEOKARqKYmEyjWGhmhLpzcncyu7Jf8aZ9bjDic",
|
||||
"SessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJRMzFDVlMxUFNDSjRPVEsyWVZFTSIsImF0X2hhc2giOiI4amItZFE2OXRtZEVueUZaMUttNWhnIiwiYXVkIjoiZXhhbXBsZS1hcHAiLCJlbWFpbCI6ImFkbWluQGV4YW1wbGUuY29tIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsImV4cCI6IjE1OTQ2MDAxODIiLCJpYXQiOjE1OTQ1ODkzODQsImlzcyI6Imh0dHA6Ly8xMjcuMC4wLjE6NTU1Ni9kZXgiLCJuYW1lIjoiYWRtaW4iLCJzdWIiOiJDaVF3T0dFNE5qZzBZaTFrWWpnNExUUmlOek10T1RCaE9TMHpZMlF4TmpZeFpqVTBOallTQld4dlkyRnMifQ.nrbzIJz99Om7TvJ04jnSTmhvlM7aR9hMM1Aqjp2ONJ1UKYCvegBLrTu6cYR968_OpmnAGJ8vkd7sIjUjtR4zbw",
|
||||
"SignerType": 1
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Now you have successfully configured Dex IdP with MinIO.
|
||||
|
||||
> NOTE: Dex supports groups with external connectors so you can use `groups` as policy claim instead of `name`.
|
||||
|
||||
```
|
||||
export MINIO_IDENTITY_OPENID_CLAIM_NAME=groups
|
||||
```
|
||||
|
||||
@@ -1,11 +1,15 @@
|
||||
# etcd V3 Quickstart Guide [](https://slack.min.io)
|
||||
|
||||
etcd is a distributed key value store that provides a reliable way to store data across a cluster of machines.
|
||||
|
||||
## Get started
|
||||
|
||||
### 1. Prerequisites
|
||||
|
||||
- Docker 18.03 or above, refer here for [installation](https://docs.docker.com/install/).
|
||||
|
||||
### 2. Start etcd
|
||||
|
||||
etcd uses [gcr.io/etcd-development/etcd](https://console.cloud.google.com/gcr/images/etcd-development/GLOBAL/etcd) as a primary container registry.
|
||||
|
||||
```
|
||||
@@ -32,7 +36,9 @@ rm -rf /tmp/etcd-data.tmp && mkdir -p /tmp/etcd-data.tmp && \
|
||||
You may also setup etcd with TLS following this documentation [here](https://coreos.com/etcd/docs/latest/op-guide/security.html)
|
||||
|
||||
### 3. Setup MinIO with etcd
|
||||
|
||||
MinIO server expects environment variable for etcd as `MINIO_ETCD_ENDPOINTS`, this environment variable takes many comma separated entries.
|
||||
|
||||
```
|
||||
export MINIO_ETCD_ENDPOINTS=http://localhost:2379
|
||||
minio server /data
|
||||
@@ -41,6 +47,7 @@ minio server /data
|
||||
NOTE: If `etcd` is configured with `Client-to-server authentication with HTTPS client certificates` then you need to use additional envs such as `MINIO_ETCD_CLIENT_CERT` pointing to path to `etcd-client.crt` and `MINIO_ETCD_CLIENT_CERT_KEY` path to `etcd-client.key` .
|
||||
|
||||
### 4. Test with MinIO STS API
|
||||
|
||||
Once etcd is configured, **any STS configuration** will work including Client Grants, Web Identity or AD/LDAP.
|
||||
|
||||
For example, you can configure STS with Client Grants (KeyCloak) using the guides at [MinIO STS Quickstart Guide](https://docs.min.io/docs/minio-sts-quickstart-guide) and [KeyCloak Configuration Guide](https://github.com/minio/minio/blob/master/docs/sts/keycloak.md). Once this is done, STS credentials can be generated:
|
||||
@@ -50,15 +57,16 @@ go run client-grants.go -cid PoEgXP6uVO45IsENRngDXj5Au5Ya -csec eKsw6z8CtOJVBtrO
|
||||
|
||||
##### Credentials
|
||||
{
|
||||
"accessKey": "IRBLVDGN5QGMDCMO1X8V",
|
||||
"secretKey": "KzS3UZKE7xqNdtRbKyfcWgxBS6P1G4kwZn4DXKuY",
|
||||
"expiration": "2018-08-21T15:49:38-07:00",
|
||||
"sessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJJUkJMVkRHTjVRR01EQ01PMVg4ViIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTM0ODkxNzc4LCJpYXQiOjE1MzQ4ODgxNzgsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiMTg0NDMyOWMtZDY1YS00OGEzLTgyMjgtOWRmNzNmZTgzZDU2In0.4rKsZ8VkZnIS_ALzfTJ9UbEKPFlQVvIyuHw6AWTJcDFDVgQA2ooQHmH9wUDnhXBi1M7o8yWJ47DXP-TLPhwCgQ"
|
||||
"accessKey": "IRBLVDGN5QGMDCMO1X8V",
|
||||
"secretKey": "KzS3UZKE7xqNdtRbKyfcWgxBS6P1G4kwZn4DXKuY",
|
||||
"expiration": "2018-08-21T15:49:38-07:00",
|
||||
"sessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJJUkJMVkRHTjVRR01EQ01PMVg4ViIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTM0ODkxNzc4LCJpYXQiOjE1MzQ4ODgxNzgsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiMTg0NDMyOWMtZDY1YS00OGEzLTgyMjgtOWRmNzNmZTgzZDU2In0.4rKsZ8VkZnIS_ALzfTJ9UbEKPFlQVvIyuHw6AWTJcDFDVgQA2ooQHmH9wUDnhXBi1M7o8yWJ47DXP-TLPhwCgQ"
|
||||
}
|
||||
```
|
||||
|
||||
These credentials can now be used to perform MinIO API operations, these credentials automatically expire in 1hr. To understand more about credential expiry duration and client grants STS API read further [here](https://github.com/minio/minio/blob/master/docs/sts/client-grants.md).
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO STS Quickstart Guide](https://docs.min.io/docs/minio-sts-quickstart-guide)
|
||||
- [The MinIO documentation website](https://docs.min.io)
|
||||
|
||||
@@ -5,9 +5,10 @@ Keycloak is an open source Identity and Access Management solution aimed at mode
|
||||
## Prerequisites
|
||||
|
||||
Configure and install keycloak server by following [Keycloak Installation Guide](https://www.keycloak.org/docs/latest/server_installation/#installing-the-software).
|
||||
For a quick installation, docker-compose reference configs are also available on the [Keycloak GitHub](https://github.com/keycloak/keycloak-containers/tree/main/docker-compose-examples).
|
||||
For a quick installation, docker-compose reference configs are also available on the [Keycloak GitHub](https://github.com/keycloak/keycloak-containers/tree/main/docker-compose-examples).
|
||||
|
||||
### Configure Keycloak Realm
|
||||
|
||||
- Go to Clients
|
||||
- Click on account
|
||||
- Settings
|
||||
@@ -38,9 +39,10 @@ For a quick installation, docker-compose reference configs are also available on
|
||||
- `Claim JSON Type` is `string`
|
||||
- Save
|
||||
|
||||
- Open http://localhost:8080/auth/realms/{your-realm-name}/.well-known/openid-configuration to verify OpenID discovery document, verify it has `authorization_endpoint` and `jwks_uri`
|
||||
- Open <http://localhost:8080/auth/realms/{your-realm-name}/.well-known/openid-configuration> to verify OpenID discovery document, verify it has `authorization_endpoint` and `jwks_uri`
|
||||
|
||||
### Enable Keycloak Admin REST API support
|
||||
|
||||
Before being able to authenticate against the Admin REST API using a client_id and a client_secret you need to make sure the client is configured as it follows:
|
||||
|
||||
- `account` client_id is a confidential client that belongs to the realm `{realm}`
|
||||
@@ -77,13 +79,15 @@ curl \
|
||||
```
|
||||
|
||||
### Configure MinIO
|
||||
|
||||
```
|
||||
$ export MINIO_ROOT_USER=minio
|
||||
$ export MINIO_ROOT_PASSWORD=minio123
|
||||
$ minio server /mnt/export
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
minio server /mnt/export
|
||||
```
|
||||
|
||||
Here are all the available options to configure OpenID connect
|
||||
|
||||
```
|
||||
mc admin config set myminio/ identity_openid
|
||||
|
||||
@@ -100,6 +104,7 @@ comment (sentence) optionally add a comment to this setting
|
||||
```
|
||||
|
||||
and ENV based options
|
||||
|
||||
```
|
||||
mc admin config set myminio/ identity_openid --env
|
||||
|
||||
@@ -116,17 +121,21 @@ MINIO_IDENTITY_OPENID_COMMENT (sentence) optionally add a comment to this
|
||||
```
|
||||
|
||||
Set `identity_openid` config with `config_url`, `client_id` and restart MinIO
|
||||
|
||||
```
|
||||
~ mc admin config set myminio identity_openid config_url="http://localhost:8080/auth/realms/{your-realm-name}/.well-known/openid-configuration" client_id="account"
|
||||
```
|
||||
|
||||
> NOTE: You can configure the `scopes` parameter to restrict the OpenID scopes requested by minio to the IdP, for example, `"openid,policy_role_attribute"`, being `policy_role_attribute` a client_scope / client_mapper that maps a role attribute called policy to a `policy` claim returned by Keycloak
|
||||
|
||||
Once successfully set restart the MinIO instance.
|
||||
|
||||
```
|
||||
mc admin service restart myminio
|
||||
```
|
||||
|
||||
### Using WebIdentiy API
|
||||
|
||||
Client ID can be found by clicking any of the clients listed [here](http://localhost:8080/auth/admin/master/console/#/realms/minio/clients). If you have followed the above steps docs, the default Client ID will be `account`.
|
||||
|
||||
```
|
||||
@@ -156,7 +165,7 @@ These credentials can now be used to perform MinIO API operations.
|
||||
|
||||
### Using MinIO Console
|
||||
|
||||
- Open MinIO URL on the browser, lets say http://localhost:9000/
|
||||
- Open MinIO URL on the browser, lets say <http://localhost:9000/>
|
||||
- Click on `Login with SSO`
|
||||
- User will be redirected to the Keycloak user login page, upon successful login the user will be redirected to MinIO page and logged in automatically,
|
||||
the user should see now the buckets and objects they have access to.
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
# AssumeRoleWithLDAPIdentity [](https://slack.min.io)
|
||||
|
||||
## Introduction
|
||||
|
||||
MinIO provides a custom STS API that allows integration with LDAP based corporate environments including Microsoft Active Directory. The MinIO server uses a separate LDAP service account to lookup user information. The login flow for a user is as follows:
|
||||
|
||||
- User provides their AD/LDAP username and password to the STS API.
|
||||
@@ -21,7 +22,6 @@ To ensure that changes in the LDAP directory are reflected in object storage acc
|
||||
|
||||
**Please note that when AD/LDAP is configured, MinIO will not support long term users defined internally.** Only AD/LDAP users (and the root user) are allowed. In addition to this, the server will not support operations on users or groups using `mc admin user` or `mc admin group` commands except `mc admin user info` and `mc admin group info` to list set policies for users and groups. This is because users and groups are defined externally in AD/LDAP.
|
||||
|
||||
|
||||
## Configuring AD/LDAP on MinIO
|
||||
|
||||
LDAP STS configuration can be performed via MinIO's standard configuration API (i.e. using `mc admin config set/get` commands) or equivalently via environment variables. For brevity we refer to environment variables here.
|
||||
@@ -116,7 +116,7 @@ export MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY=on
|
||||
|
||||
### Variable substitution in configuration strings
|
||||
|
||||
In the configuration variables, `%s` is substituted with the *username* from the STS request and `%d` is substituted with the *distinguished username (user DN)* of the LDAP user. Please see the following table for which configuration variables support these substitution variables:
|
||||
In the configuration variables, `%s` is substituted with the _username_ from the STS request and `%d` is substituted with the _distinguished username (user DN)_ of the LDAP user. Please see the following table for which configuration variables support these substitution variables:
|
||||
|
||||
| Variable | Supported substitutions |
|
||||
|---------------------------------------------|-------------------------|
|
||||
@@ -146,62 +146,70 @@ mc admin policy set myminio mypolicy group='cn=projectx,ou=groups,ou=hwengg,dc=m
|
||||
## API Request Parameters
|
||||
|
||||
### LDAPUsername
|
||||
|
||||
Is AD/LDAP username to login. Application must ask user for this value to successfully obtain rotating access credentials from AssumeRoleWithLDAPIdentity.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *String* |
|
||||
| *Length Constraints* | *Minimum length of 2. Maximum length of 2048.* |
|
||||
| *Required* | *Yes* |
|
||||
|
||||
| _Type_ | _String_ |
|
||||
| _Length Constraints_ | _Minimum length of 2. Maximum length of 2048._ |
|
||||
| _Required_ | _Yes_ |
|
||||
|
||||
### LDAPPassword
|
||||
|
||||
Is AD/LDAP username password to login. Application must ask user for this value to successfully obtain rotating access credentials from AssumeRoleWithLDAPIdentity.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *String* |
|
||||
| *Length Constraints* | *Minimum length of 4. Maximum length of 2048.* |
|
||||
| *Required* | *Yes* |
|
||||
| _Type_ | _String_ |
|
||||
| _Length Constraints_ | _Minimum length of 4. Maximum length of 2048._ |
|
||||
| _Required_ | _Yes_ |
|
||||
|
||||
### Version
|
||||
|
||||
Indicates STS API version information, the only supported value is '2011-06-15'. This value is borrowed from AWS STS API documentation for compatibility reasons.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *String* |
|
||||
| *Required* | *Yes* |
|
||||
| _Type_ | _String_ |
|
||||
| _Required_ | _Yes_ |
|
||||
|
||||
### DurationSeconds
|
||||
|
||||
The duration, in seconds. The value can range from 900 seconds (15 minutes) up to 365 days. If value is higher than this setting, then operation fails. By default, the value is set to 3600 seconds.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *Integer* |
|
||||
| *Valid Range* | *Minimum value of 900. Maximum value of 31536000.* |
|
||||
| *Required* | *No* |
|
||||
| _Type_ | _Integer_ |
|
||||
| _Valid Range_ | _Minimum value of 900. Maximum value of 31536000._ |
|
||||
| _Required_ | _No_ |
|
||||
|
||||
### Policy
|
||||
|
||||
An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this operation returns new temporary credentials. The resulting session's permissions are the intersection of the canned policy name and the policy set here. You cannot use this policy to grant more permissions than those allowed by the canned policy name being assumed.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *String* |
|
||||
| *Valid Range* | *Minimum length of 1. Maximum length of 2048.* |
|
||||
| *Required* | *No* |
|
||||
| _Type_ | _String_ |
|
||||
| _Valid Range_ | _Minimum length of 1. Maximum length of 2048._ |
|
||||
| _Required_ | _No_ |
|
||||
|
||||
### Response Elements
|
||||
|
||||
XML response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_ResponseElements)
|
||||
|
||||
### Errors
|
||||
|
||||
XML error response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_Errors)
|
||||
|
||||
## Sample `POST` Request
|
||||
|
||||
```
|
||||
http://minio.cluster:9000?Action=AssumeRoleWithLDAPIdentity&LDAPUsername=foouser&LDAPPassword=foouserpassword&Version=2011-06-15&DurationSeconds=7200
|
||||
```
|
||||
|
||||
## Sample Response
|
||||
|
||||
```
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<AssumeRoleWithLDAPIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
|
||||
@@ -224,17 +232,20 @@ http://minio.cluster:9000?Action=AssumeRoleWithLDAPIdentity&LDAPUsername=foouser
|
||||
## Using LDAP STS API
|
||||
|
||||
With multiple OU hierarchies for users, and multiple group search base DN's.
|
||||
|
||||
```
|
||||
$ export MINIO_ROOT_USER=minio
|
||||
$ export MINIO_ROOT_PASSWORD=minio123
|
||||
$ export MINIO_IDENTITY_LDAP_SERVER_ADDR='my.ldap-active-dir-server.com:636'
|
||||
$ export MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN='cn=admin,dc=min,dc=io'
|
||||
$ export MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD=admin
|
||||
$ export MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN='dc=minioad,dc=local;dc=somedomain,dc=com'
|
||||
$ export MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER='(&(objectclass=groupOfNames)(member=%d))'
|
||||
$ minio server ~/test
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
export MINIO_IDENTITY_LDAP_SERVER_ADDR='my.ldap-active-dir-server.com:636'
|
||||
export MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN='cn=admin,dc=min,dc=io'
|
||||
export MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD=admin
|
||||
export MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN='dc=minioad,dc=local;dc=somedomain,dc=com'
|
||||
export MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER='(&(objectclass=groupOfNames)(member=%d))'
|
||||
minio server ~/test
|
||||
```
|
||||
|
||||
You can make sure it works appropriately using our [example program](https://raw.githubusercontent.com/minio/minio/master/docs/sts/ldap.go):
|
||||
|
||||
```
|
||||
$ go run ldap.go -u foouser -p foopassword
|
||||
|
||||
@@ -248,5 +259,6 @@ $ go run ldap.go -u foouser -p foopassword
|
||||
```
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO Admin Complete Guide](https://docs.min.io/docs/minio-admin-complete-guide.html)
|
||||
- [The MinIO documentation website](https://docs.min.io)
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
# AssumeRoleWithCertificate [](https://slack.min.io)
|
||||
|
||||
## Introduction
|
||||
|
||||
MinIO provides a custom STS API that allows authentication with client X.509 / TLS certificates.
|
||||
|
||||
A major advantage of certificate-based authentication compared to other STS authentication methods, like OpenID Connect or LDAP/AD, is that client authentication works without any additional/external component that must be constantly available. Therefore, certificate-based authentication may provide better availability / lower operational complexity.
|
||||
@@ -17,11 +18,13 @@ MINIO_IDENTITY_TLS_SKIP_VERIFY (on|off) trust client certificates without ve
|
||||
```
|
||||
|
||||
The MinIO TLS STS API is disabled by default. However, it can be *enabled* by setting environment variable:
|
||||
|
||||
```
|
||||
export MINIO_IDENTITY_TLS_ENABLE=on
|
||||
```
|
||||
|
||||
## Example
|
||||
|
||||
MinIO exposes a custom S3 STS API endpoint as `Action=AssumeRoleWithCertificate`. A client has to send an HTTP `POST` request to `https://<host>:<port>?Action=AssumeRoleWithCertificate&Version=2011-06-15`. Since the authentication and authorization happens via X.509 certificates the client has to send the request over **TLS** and has to provide
|
||||
a client certificate.
|
||||
|
||||
@@ -55,6 +58,7 @@ A client can request temp. S3 credentials via the STS API. It can authenticate v
|
||||
In case of certificate-based authentication, MinIO has to map the client-provided certificate to an S3 policy. MinIO does this via the subject common name field of the X.509 certificate. So, MinIO will associate a certificate with a subject `CN = foobar` to a S3 policy named `foobar`.
|
||||
|
||||
The following self-signed certificate is issued for `consoleAdmin`. So, MinIO would associate it with the pre-defined `consoleAdmin` policy.
|
||||
|
||||
```
|
||||
Certificate:
|
||||
Data:
|
||||
@@ -87,6 +91,7 @@ Certificate:
|
||||
7d:ab:b8:e9:75:ec:b4:39:fb:c8:cf:53:16:5b:1f:15:b6:7f:
|
||||
5a:d1:35:2d:fc:31:3a:10:e7:0c
|
||||
```
|
||||
|
||||
> Observe the `Subject: CN = consoleAdmin` field.
|
||||
|
||||
Also, note that the certificate has to contain the `Extended Key Usage: TLS Web Client Authentication`. Otherwise, MinIO would not accept the certificate as client certificate.
|
||||
@@ -106,7 +111,7 @@ Further, the temp. S3 credentials will never out-live the client certificate. Fo
|
||||
|
||||
*Applications that use direct S3 API will work fine, however interactive users uploading content using (when POSTing to the presigned URL an app generates) a popup becomes visible on browser to provide client certs, you would have to manually cancel and continue. This may be annoying to use but there is no workaround for now.*
|
||||
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO Admin Complete Guide](https://docs.min.io/docs/minio-admin-complete-guide.html)
|
||||
- [The MinIO documentation website](https://docs.min.io)
|
||||
|
||||
@@ -8,14 +8,16 @@ By default, the temporary security credentials created by AssumeRoleWithWebIdent
|
||||
|
||||
## Access Control Policies
|
||||
|
||||
MinIO's AssumeRoleWithWebIdentity supports specifying access control policies in two ways:
|
||||
MinIO's AssumeRoleWithWebIdentity supports specifying access control policies in two ways:
|
||||
|
||||
1. Role Policy (Recommended): When specified, all users authenticating via this API are authorized to (only) use the specified role policy. The policy to associate with such users is specified when configuring OpenID provider in the server, via the `role_policy` configuration parameter or the `MINIO_IDENTITY_OPENID_ROLE_POLICY` environment variable. The value is a comma-separated list of IAM access policy names already defined in the server. In this situation, the server prints a role ARN at startup that must be specified as a `RoleARN` API request parameter in the STS AssumeRoleWithWebIdentity API call.
|
||||
|
||||
2. `id_token` claims: When the role policy is not configured, MinIO looks for a specific claim in the `id_token` (JWT) returned by the OpenID provider. The default claim is `policy` and can be overridden by the `claim_name` configuration parameter or the `MINIO_IDENTITY_OPENID_CLAIM_NAME` environment variable. The claim value can be a string (comma-separated list) or an array of IAM access policy names defined in the server. A `RoleARN` API request parameter *must not* be specified in the STS AssumeRoleWithWebIdentity API call.
|
||||
|
||||
## API Request Parameters
|
||||
|
||||
### WebIdentityToken
|
||||
|
||||
The OAuth 2.0 id_token that is provided by the web identity provider. Application must get this token by authenticating the user who is using your application with a web identity provider before the application makes an AssumeRoleWithWebIdentity call.
|
||||
|
||||
| Params | Value |
|
||||
@@ -25,6 +27,7 @@ The OAuth 2.0 id_token that is provided by the web identity provider. Applicatio
|
||||
| *Required* | *Yes* |
|
||||
|
||||
### WebIdentityAccessToken (MinIO Extension)
|
||||
|
||||
There are situations when identity provider does not provide user claims in `id_token` instead it needs to be retrieved from UserInfo endpoint, this extension is only useful in this scenario. This is rare so use it accordingly depending on your Identity provider implementation. `access_token` is available as part of the OIDC authentication flow similar to `id_token`.
|
||||
|
||||
| Params | Value |
|
||||
@@ -33,6 +36,7 @@ There are situations when identity provider does not provide user claims in `id_
|
||||
| *Required* | *No* |
|
||||
|
||||
### RoleARN
|
||||
|
||||
The role ARN to use. This must be specified if and only if the web identity provider is configured with a role policy.
|
||||
|
||||
| Params | Value |
|
||||
@@ -41,6 +45,7 @@ The role ARN to use. This must be specified if and only if the web identity prov
|
||||
| *Required* | *No* |
|
||||
|
||||
### Version
|
||||
|
||||
Indicates STS API version information, the only supported value is '2011-06-15'. This value is borrowed from AWS STS API documentation for compatibility reasons.
|
||||
|
||||
| Params | Value |
|
||||
@@ -49,6 +54,7 @@ Indicates STS API version information, the only supported value is '2011-06-15'.
|
||||
| *Required* | *Yes* |
|
||||
|
||||
### DurationSeconds
|
||||
|
||||
The duration, in seconds. The value can range from 900 seconds (15 minutes) up to 365 days. If value is higher than this setting, then operation fails. By default, the value is set to 3600 seconds. If no *DurationSeconds* is specified expiry seconds is obtained from *WebIdentityToken*.
|
||||
|
||||
| Params | Value |
|
||||
@@ -58,6 +64,7 @@ The duration, in seconds. The value can range from 900 seconds (15 minutes) up t
|
||||
| *Required* | *No* |
|
||||
|
||||
### Policy
|
||||
|
||||
An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this operation returns new temporary credentials. The resulting session's permissions are the intersection of the canned policy name and the policy set here. You cannot use this policy to grant more permissions than those allowed by the canned policy name being assumed.
|
||||
|
||||
| Params | Value |
|
||||
@@ -67,17 +74,21 @@ An IAM policy in JSON format that you want to use as an inline session policy. T
|
||||
| *Required* | *No* |
|
||||
|
||||
### Response Elements
|
||||
|
||||
XML response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_ResponseElements)
|
||||
|
||||
### Errors
|
||||
|
||||
XML error response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_Errors)
|
||||
|
||||
## Sample `POST` Request
|
||||
|
||||
```
|
||||
http://minio.cluster:9000?Action=AssumeRoleWithWebIdentity&DurationSeconds=3600&WebIdentityToken=eyJ4NXQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJraWQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiYXpwIjoiUG9FZ1hQNnVWTzQ1SXNFTlJuZ0RYajVBdTVZYSIsImlzcyI6Imh0dHBzOlwvXC9sb2NhbGhvc3Q6OTQ0M1wvb2F1dGgyXC90b2tlbiIsImV4cCI6MTU0MTgwOTU4MiwiaWF0IjoxNTQxODA1OTgyLCJqdGkiOiI2Y2YyMGIwZS1lNGZmLTQzZmQtYTdiYS1kYTc3YTE3YzM2MzYifQ.Jm29jPliRvrK6Os34nSK3rhzIYLFjE__zdVGNng3uGKXGKzP3We_i6NPnhA0szJXMOKglXzUF1UgSz8MctbaxFS8XDusQPVe4LkB_45hwBm6TmBxzui911nt-1RbBLN_jZIlvl2lPrbTUH5hSn9kEkph6seWanTNQpz9tNEoVa6R_OX3kpJqxe8tLQUWw453A1JTwFNhdHa6-f1K8_Q_eEZ_4gOYINQ9t_fhTibdbkXZkJQFLop-Jwoybi9s4nwQU_dATocgcufq5eCeNItQeleT-23lGxIz0X7CiJrJynYLdd-ER0F77SumqEb5iCxhxuf4H7dovwd1kAmyKzLxpw&Version=2011-06-15
|
||||
```
|
||||
|
||||
## Sample Response
|
||||
|
||||
```
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
|
||||
@@ -98,6 +109,7 @@ http://minio.cluster:9000?Action=AssumeRoleWithWebIdentity&DurationSeconds=3600&
|
||||
```
|
||||
|
||||
## Using WebIdentity API
|
||||
|
||||
```
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
@@ -109,6 +121,7 @@ minio server /mnt/export
|
||||
```
|
||||
|
||||
or using `mc`
|
||||
|
||||
```
|
||||
mc admin config get myminio identity_openid
|
||||
identity_openid config_url=https://accounts.google.com/.well-known/openid-configuration client_id=843351d4-1080-11ea-aa20-271ecba3924a
|
||||
@@ -123,6 +136,7 @@ $ go run web-identity.go -cid 204367807228-ok7601k6gj1pgge7m09h7d79co8p35xx.apps
|
||||
```
|
||||
|
||||
> NOTE: for a reasonable test outcome, make sure the assumed user has at least permission/policy to list all buckets. That policy would look like below:
|
||||
|
||||
```
|
||||
{
|
||||
"version": "2012-10-17",
|
||||
@@ -142,13 +156,14 @@ $ go run web-identity.go -cid 204367807228-ok7601k6gj1pgge7m09h7d79co8p35xx.apps
|
||||
|
||||
## Authorization Flow
|
||||
|
||||
- Visit http://localhost:8080, login will direct the user to the Google OAuth2 Auth URL to obtain a permission grant.
|
||||
- Visit <http://localhost:8080>, login will direct the user to the Google OAuth2 Auth URL to obtain a permission grant.
|
||||
- The redirection URI (callback handler) receives the OAuth2 callback, verifies the state parameter, and obtains a Token.
|
||||
- Using the id_token the callback handler further talks to Google OAuth2 Token URL to obtain an JWT id_token.
|
||||
- Once obtained the JWT id_token is further sent to STS endpoint i.e MinIO to retrieve temporary credentials.
|
||||
- Temporary credentials are displayed on the browser upon successful retrieval.
|
||||
|
||||
## Using MinIO Console
|
||||
|
||||
To support WebIdentity based login for MinIO Console, set openid configuration and restart MinIO
|
||||
|
||||
```
|
||||
@@ -170,5 +185,6 @@ JWT token returned by the Identity Provider should include a custom claim for th
|
||||
- Upon successful login on Identity Provider page the user will be automatically logged into MinIO Console.
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO Admin Complete Guide](https://docs.min.io/docs/minio-admin-complete-guide.html)
|
||||
- [The MinIO documentation website](https://docs.min.io)
|
||||
|
||||
@@ -1,12 +1,16 @@
|
||||
# WSO2 Quickstart Guide [](https://slack.min.io)
|
||||
|
||||
WSO2 is an Identity Server open source and is released under Apache Software License Version 2.0, this document covers configuring WSO2 to be used as an identity provider for MinIO server STS API.
|
||||
|
||||
## Get started
|
||||
|
||||
### 1. Prerequisites
|
||||
|
||||
- JAVA 1.8 and above installed already and JAVA_HOME points to JAVA 1.8 installation.
|
||||
- Download WSO2 follow their [installation guide](https://docs.wso2.com/display/IS540/Installation+Guide).
|
||||
|
||||
### 2. Configure WSO2
|
||||
|
||||
Once WSO2 is up and running, configure WSO2 to generate Self contained id_tokens. In OAuth 2.0 specification there are primarily two ways to provide id_tokens
|
||||
|
||||
1. The id_token is an identifier that is hard to guess. For example, a randomly generated string of sufficient length, that the server handling the protected resource can use to lookup the associated authorization information.
|
||||
@@ -15,12 +19,15 @@ Once WSO2 is up and running, configure WSO2 to generate Self contained id_tokens
|
||||
WSO2 generates tokens in first style by default, but if to be used with MinIO we should configure WSO2 to provide JWT tokens instead.
|
||||
|
||||
### 3. Generate Self-contained Access Tokens
|
||||
|
||||
By default, a UUID is issued as an id_token in WSO2 Identity Server, which is of the first type above. But, it also can be configured to issue a self-contained id_token (JWT), which is of the second type above.
|
||||
|
||||
- Open the `<IS_HOME>/repository/conf/identity/identity.xml` file and uncomment the following entry under `<OAuth>` element.
|
||||
|
||||
```
|
||||
<IdentityOAuthTokenGenerator>org.wso2.carbon.identity.oauth2.token.JWTTokenIssuer</IdentityOAuthTokenGenerator>
|
||||
```
|
||||
|
||||
- Restart the server.
|
||||
- Configure an [OAuth service provider](https://docs.wso2.com/display/IS540/Adding+and+Configuring+a+Service+Provider).
|
||||
- Initiate an id_token request to the WSO2 Identity Server, over a known [grant type](https://docs.wso2.com/display/IS540/OAuth+2.0+Grant+Types). For example, the following cURL command illustrates the syntax of an id_token request that can be initiated over the [Client Credentials Grant](https://docs.wso2.com/display/IS540/Client+Credentials+Grant) grant type.
|
||||
@@ -31,16 +38,19 @@ By default, a UUID is issued as an id_token in WSO2 Identity Server, which is of
|
||||
- By default, `<IS_HTTPS_PORT>` has been set to 9443. However, if the port offset has been incremented by n, the default port value needs to be incremented by n.
|
||||
|
||||
Request
|
||||
|
||||
```
|
||||
curl -u <CLIENT_ID>:<CLIENT_SECRET> -k -d "grant_type=client_credentials" -H "Content-Type:application/x-www-form-urlencoded" https://<IS_HOST>:<IS_HTTPS_PORT>/oauth2/token
|
||||
```
|
||||
|
||||
Example:
|
||||
|
||||
```
|
||||
curl -u PoEgXP6uVO45IsENRngDXj5Au5Ya:eKsw6z8CtOJVBtrOWvhRWL4TUCga -k -d "grant_type=client_credentials" -H "Content-Type:application/x-www-form-urlencoded" https://localhost:9443/oauth2/token
|
||||
```
|
||||
|
||||
In response, the self-contained JWT id_token will be returned as shown below.
|
||||
|
||||
```
|
||||
{
|
||||
"id_token": "eyJ4NXQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJraWQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiYXpwIjoiUG9FZ1hQNnVWTzQ1SXNFTlJuZ0RYajVBdTVZYSIsImlzcyI6Imh0dHBzOlwvXC9sb2NhbGhvc3Q6OTQ0M1wvb2F1dGgyXC90b2tlbiIsImV4cCI6MTUzNDg5MTc3OCwiaWF0IjoxNTM0ODg4MTc4LCJqdGkiOiIxODQ0MzI5Yy1kNjVhLTQ4YTMtODIyOC05ZGY3M2ZlODNkNTYifQ.ELZ8ujk2Xp9xTGgMqnCa5ehuimaAPXWlSCW5QeBbTJIT4M5OB_2XEVIV6p89kftjUdKu50oiYe4SbfrxmLm6NGSGd2qxkjzJK3SRKqsrmVWEn19juj8fz1neKtUdXVHuSZu6ws_bMDy4f_9hN2Jv9dFnkoyeNT54r4jSTJ4A2FzN2rkiURheVVsc8qlm8O7g64Az-5h4UGryyXU4zsnjDCBKYk9jdbEpcUskrFMYhuUlj1RWSASiGhHHHDU5dTRqHkVLIItfG48k_fb-ehU60T7EFWH1JBdNjOxM9oN_yb0hGwOjLUyCUJO_Y7xcd5F4dZzrBg8LffFmvJ09wzHNtQ",
|
||||
@@ -50,6 +60,7 @@ In response, the self-contained JWT id_token will be returned as shown below.
|
||||
```
|
||||
|
||||
### 4. JWT Claims
|
||||
|
||||
The id_token received is a signed JSON Web Token (JWT). Use a JWT decoder to decode the id_token to access the payload of the token that includes following JWT claims:
|
||||
|
||||
| Claim Name | Type | Claim Value |
|
||||
@@ -67,7 +78,9 @@ Using the above `id_token` we can perform an STS request to MinIO to get tempora
|
||||
**We recommend setting `policy` as a custom claim for the JWT service provider follow [here](https://docs.wso2.com/display/IS550/Configuring+Claims+for+a+Service+Provider) and [here](https://docs.wso2.com/display/IS550/Handling+Custom+Claims+with+the+JWT+Bearer+Grant+Type) for relevant docs on how to configure claims for a service provider.**
|
||||
|
||||
### 5. Setup MinIO with OpenID configuration URL
|
||||
|
||||
MinIO server expects environment variable for OpenID configuration url as `MINIO_IDENTITY_OPENID_CONFIG_URL`, this environment variable takes a single entry.
|
||||
|
||||
```
|
||||
export MINIO_IDENTITY_OPENID_CONFIG_URL=https://localhost:9443/oauth2/oidcdiscovery/.well-known/openid-configuration
|
||||
export MINIO_IDENTITY_OPENID_CLIENT_ID="843351d4-1080-11ea-aa20-271ecba3924a"
|
||||
@@ -75,20 +88,22 @@ minio server /mnt/data
|
||||
```
|
||||
|
||||
Assuming that MinIO server is configured to support STS API by following the doc [MinIO STS Quickstart Guide](https://docs.min.io/docs/minio-sts-quickstart-guide), execute the following command to temporary credentials from MinIO server.
|
||||
|
||||
```
|
||||
go run client-grants.go -cid PoEgXP6uVO45IsENRngDXj5Au5Ya -csec eKsw6z8CtOJVBtrOWvhRWL4TUCga
|
||||
|
||||
##### Credentials
|
||||
{
|
||||
"accessKey": "IRBLVDGN5QGMDCMO1X8V",
|
||||
"secretKey": "KzS3UZKE7xqNdtRbKyfcWgxBS6P1G4kwZn4DXKuY",
|
||||
"expiration": "2018-08-21T15:49:38-07:00",
|
||||
"sessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJJUkJMVkRHTjVRR01EQ01PMVg4ViIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTM0ODkxNzc4LCJpYXQiOjE1MzQ4ODgxNzgsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiMTg0NDMyOWMtZDY1YS00OGEzLTgyMjgtOWRmNzNmZTgzZDU2In0.4rKsZ8VkZnIS_ALzfTJ9UbEKPFlQVvIyuHw6AWTJcDFDVgQA2ooQHmH9wUDnhXBi1M7o8yWJ47DXP-TLPhwCgQ"
|
||||
"accessKey": "IRBLVDGN5QGMDCMO1X8V",
|
||||
"secretKey": "KzS3UZKE7xqNdtRbKyfcWgxBS6P1G4kwZn4DXKuY",
|
||||
"expiration": "2018-08-21T15:49:38-07:00",
|
||||
"sessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJJUkJMVkRHTjVRR01EQ01PMVg4ViIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTM0ODkxNzc4LCJpYXQiOjE1MzQ4ODgxNzgsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiMTg0NDMyOWMtZDY1YS00OGEzLTgyMjgtOWRmNzNmZTgzZDU2In0.4rKsZ8VkZnIS_ALzfTJ9UbEKPFlQVvIyuHw6AWTJcDFDVgQA2ooQHmH9wUDnhXBi1M7o8yWJ47DXP-TLPhwCgQ"
|
||||
}
|
||||
```
|
||||
|
||||
These credentials can now be used to perform MinIO API operations, these credentials automatically expire in 1hr. To understand more about credential expiry duration and client grants STS API read further [here](https://github.com/minio/minio/blob/master/docs/sts/client-grants.md).
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO STS Quickstart Guide](https://docs.min.io/docs/minio-sts-quickstart-guide)
|
||||
- [The MinIO documentation website](https://docs.min.io)
|
||||
|
||||
Reference in New Issue
Block a user