Replication
Console
Cache
Encryption
Versioning
Observability
Object Immutability
Key Management Server
S3 Compatibility
Identity + Access Mgt
Catalog
Object Prompt
Lifecycle
Firewall
AIHub
Erasure Code Calculator
Reference Hardware
Integrations with MinIO
Download MinIO Object Store
Events
MinIO Identity Management Plugin Settings
This page documents settings for enabling external identity management using the MinIO Identity Management Plugin. See MinIO External Identity Management Plugin for a tutorial on using these settings.
You can establish or modify settings by defining:
an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using
mc admin config set.a configuration setting using the MinIO Console’s Administrator > Settings pages.
If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.
Some settings have only an environment variable or a configuration setting, but not both.
Important
Each configuration setting controls fundamental MinIO behavior and functionality. MinIO strongly recommends testing configuration changes in a lower environment, such as DEV or QA, before applying to production.
Examples
When setting up the MinIO Identity Management Plugin, you must define at a minimum all of the required settings. The examples here represent the minimum required settings.
MINIO_IDENTITY_PLUGIN_URL="https://authservice.example.net:8080/auth"
MINIO_IDENTITY_PLUGIN_ROLE_POLICY="ConsoleUser"
Use mc admin config set to create or update the identity plugin configuration.
The identity_plugin url argument is required.
Specify additional optional arguments as a whitespace (” “)-delimited list.
mc admin config set identity_plugin \
url="https://external-auth.example.net:8080/auth" \
role_policy="consoleAdmin" \
[ARGUMENT=VALUE] ...
Settings
URL
Required
The webhook endpoint for the external identity management service (https://authservice.example.net:8080/auth).
Role Policy
Required
Specify a comma-separated list of MinIO policies to assign to authenticated users.
Enable
Optional
Set to false to disable the identity provider configuration.
Applications cannot generate STS credentials or otherwise authenticate to MinIO using the configured provider if set to false.
Defaults to true or “enabled”.
Token
Optional
An authentication token to present to the configured webhook endpoint.
Specify a supported HTTP Authentication scheme as a string value, such as "Bearer TOKEN".
MinIO sends the token using the HTTP Authorization header.
Role ID
Optional
Specify a unique ID MinIO uses to generate an ARN for this identity manager.
If omitted, MinIO automatically generates the ID and prints the full ARN to the server log.
Comment
Optional
Specify a comment to associate to the identity configuration.
