mirror of
https://github.com/minio/minio.git
synced 2024-12-27 23:55:56 -05:00
5f51ef0b40
This change allows the MinIO server to be configured with a special (read-only) LDAP account to perform user DN lookups. The following configuration parameters are added (along with corresponding environment variables) to LDAP identity configuration (under `identity_ldap`): - lookup_bind_dn / MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN - lookup_bind_password / MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD - user_dn_search_base_dn / MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN - user_dn_search_filter / MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER This lookup-bind account is a service account that is used to lookup the user's DN from their username provided in the STS API. When configured, searching for the user DN is enabled and configuration of the base DN and filter for search is required. In this "lookup-bind" mode, the username format is not checked and must not be specified. This feature is to support Active Directory setups where the DN cannot be simply derived from the username. When the lookup-bind is not configured, the old behavior is enabled: the minio server performs LDAP lookups as the LDAP user making the STS API request and the username format is checked and configuring it is required.
109 lines
3.2 KiB
Go
109 lines
3.2 KiB
Go
/*
|
|
* MinIO Cloud Storage, (C) 2019 MinIO, Inc.
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
package ldap
|
|
|
|
import "github.com/minio/minio/cmd/config"
|
|
|
|
// Help template for LDAP identity feature.
|
|
var (
|
|
Help = config.HelpKVS{
|
|
config.HelpKV{
|
|
Key: ServerAddr,
|
|
Description: `AD/LDAP server address e.g. "myldapserver.com:636"`,
|
|
Type: "address",
|
|
},
|
|
config.HelpKV{
|
|
Key: STSExpiry,
|
|
Description: `temporary credentials validity duration in s,m,h,d. Default is "1h"`,
|
|
Optional: true,
|
|
Type: "duration",
|
|
},
|
|
config.HelpKV{
|
|
Key: LookupBindDN,
|
|
Description: `DN for LDAP read-only service account used to perform DN and group lookups`,
|
|
Optional: true,
|
|
Type: "string",
|
|
},
|
|
config.HelpKV{
|
|
Key: LookupBindPassword,
|
|
Description: `Password for LDAP read-only service account used to perform DN and group lookups`,
|
|
Optional: true,
|
|
Type: "string",
|
|
},
|
|
config.HelpKV{
|
|
Key: UserDNSearchBaseDN,
|
|
Description: `Base LDAP DN to search for user DN`,
|
|
Optional: true,
|
|
Type: "string",
|
|
},
|
|
config.HelpKV{
|
|
Key: UserDNSearchFilter,
|
|
Description: `Search filter to lookup user DN`,
|
|
Optional: true,
|
|
Type: "string",
|
|
},
|
|
config.HelpKV{
|
|
Key: UsernameFormat,
|
|
Description: `";" separated list of username bind DNs e.g. "uid=%s,cn=accounts,dc=myldapserver,dc=com"`,
|
|
Optional: true,
|
|
Type: "list",
|
|
},
|
|
config.HelpKV{
|
|
Key: GroupSearchFilter,
|
|
Description: `search filter for groups e.g. "(&(objectclass=groupOfNames)(memberUid=%s))"`,
|
|
Optional: true,
|
|
Type: "string",
|
|
},
|
|
config.HelpKV{
|
|
Key: GroupNameAttribute,
|
|
Description: `search attribute for group name e.g. "cn"`,
|
|
Optional: true,
|
|
Type: "string",
|
|
},
|
|
config.HelpKV{
|
|
Key: GroupSearchBaseDN,
|
|
Description: `";" separated list of group search base DNs e.g. "dc=myldapserver,dc=com"`,
|
|
Optional: true,
|
|
Type: "list",
|
|
},
|
|
config.HelpKV{
|
|
Key: TLSSkipVerify,
|
|
Description: `trust server TLS without verification, defaults to "off" (verify)`,
|
|
Optional: true,
|
|
Type: "on|off",
|
|
},
|
|
config.HelpKV{
|
|
Key: ServerInsecure,
|
|
Description: `allow plain text connection to AD/LDAP server, defaults to "off"`,
|
|
Optional: true,
|
|
Type: "on|off",
|
|
},
|
|
config.HelpKV{
|
|
Key: ServerStartTLS,
|
|
Description: `use StartTLS connection to AD/LDAP server, defaults to "off"`,
|
|
Optional: true,
|
|
Type: "on|off",
|
|
},
|
|
config.HelpKV{
|
|
Key: config.Comment,
|
|
Description: config.DefaultComment,
|
|
Optional: true,
|
|
Type: "sentence",
|
|
},
|
|
}
|
|
)
|