Certificate Identity Settings

This page documents settings for authenticating clients with an X.509 client certificate. See AssumeRoleWithCertificate for the STS endpoint that uses them.

You can establish or modify settings by defining:

• an environment variable on the host system prior to starting or restarting the AIStor Server.
• a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO AIStor uses the environment variable value.

Required to use certificate identity

Set to on to accept AssumeRoleWithCertificate requests.

The certificate identity API is off until you set this environment variable. AIStor reads the other settings on this page only when this variable is set, so setting them alone has no effect.

Optional

Set to on to accept a client certificate without checking that a trusted certificate authority issued it.

Default value: off

Optional

Set to on to qualify the policy name from a SPIFFE identity with its trust domain, giving host/path rather than path.

Default value: off

Turn this on when you accept SVIDs from more than one trust domain, so that identical workload paths in different domains map to different policies.

Optional

Sets the URI SAN scheme that marks a client certificate as a workload identity.

Default value: spiffe

Set this when your certificate authority issues SPIFFE-shaped identities under another scheme, such as ans://example.org/billing/api. The scheme must start with a letter and may otherwise contain only letters, digits, +, -, and .. MinIO AIStor lowercases the value and matches the certificate’s scheme without regard to case. MinIO AIStor fails to start if the value does not match this syntax.

MinIO AIStor recognizes only the scheme you set here. With uri_san_scheme set to ans, a certificate that presents a spiffe:// URI SAN is not a workload identity, and MinIO AIStor maps it by subject common name instead.

The validation rules do not change. MinIO AIStor substitutes the scheme and then applies the SPIFFE rules: the certificate must carry exactly one URI SAN, its trust domain must be lowercase, and its path must not be empty. A URI that carries user information, a port, a query, or a fragment is rejected.

Credentials from AssumeRoleWithCertificate use their own bounds rather than the STS settings:

AIStor also shortens credentials that would outlive the certificate, so they expire no later than the certificate does.