mc idp ldap accesskey create-with-login

The mc idp ldap accesskey create-with-login command authenticates with the external AD/LDAP server and generates access keys for use with MinIO AIStor.

The command reads the AD/LDAP username and password from one of three sources:

A credentials file, when you specify --with-file.
The MC_LDAP_USERNAME and MC_LDAP_PASSWORD environment variables, when you specify --with-env.
An interactive terminal prompt, when you specify neither flag.

The prompt requires an interactive terminal. If standard input is not a terminal, the command exits with an error unless you specify --with-file or --with-env.

Syntax

Example

The following example prompts the user to provide their AD/LDAP credentials. It then generates a new access key pair using the policy or policies associated with that AD/LDAP user.

mc idp ldap accesskey create-with-login https://myaistor.example.net/

Syntax

The command has the following syntax:

mc [GLOBALFLAGS] idp ldap accesskey create-with-login        \
                                 URL                         \
                                 [CONFIG_NAME]               \
                                 [--with-file <value>]       \
                                 [--with-env]                \
                                 [--access-key <value>]      \
                                 [--secret-key <value>]      \
                                 [--policy <value>]          \
                                 [--name <value>]            \
                                 [--description <value>]     \
                                 [--expiry <value>]          \
                                 [--expiry-duration <value>] \
                                 [--sts-only]

Replace URL with the FQDN or IP address of a MinIO AIStor deployment configured for AD/LDAP integration.
Optionally specify CONFIG_NAME to use a non-default LDAP configuration.
Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

Parameters

URL

Required

The FQDN or IP address of a MinIO AIStor deployment configured for AD/LDAP integration.

CONFIG_NAME

Optional

The name of a non-default LDAP configuration to use. If not specified, the command uses the default LDAP configuration.

--with-file

Optional

Path to a file that holds the AD/LDAP credentials. The first line must hold the username and the second line must hold the password. The command exits with an error if the file is empty or holds fewer than two lines.

Mutually exclusive with --with-env.

--with-env

Optional

Read the AD/LDAP credentials from the MC_LDAP_USERNAME and MC_LDAP_PASSWORD environment variables. The command exits with an error if either variable is empty.

Mutually exclusive with --with-file.

--access-key

Optional

The access key to use once successfully authenticated. Omit to let MinIO AIStor randomly generate a value.

The access key cannot contain the characters = (equal sign) or , (comma).

Requires --secret-key

--secret-key

Optional

A secret key to use once successfully authenticated. Omit to let MinIO AIStor randomly generate a value.

Requires --access-key

--policy

Optional

File path to the JSON-formatted policy to use for the account. This policy cannot grant additional privileges beyond the privileges associated with the authenticated AD/LDAP user.

Omit to use the AD/LDAP user policies.

--name

Optional

A human-readable name to use for the created access key.

--description

Optional

Create a description for the service account. For example, you might specify the reason the access key exists.

--expiry-duration

Optional

Length of time the access key pair remains valid for use.

Specify the length as one or more number-unit pairs, such as 24h, 2w, or 5d12h30s. Valid units are ns (nanoseconds), us or µs (microseconds), ms (milliseconds), s (seconds), m (minutes), h (hours), d (days), w (weeks), and y (years).

mc counts one day as 24 hours, one week as 7 days, and one year as 365 days.

Mutually exclusive with --expiry.

--expiry

Optional

The future date and time when the access key expires. The access key becomes invalid at the start of the specified date and time (midnight if no time is specified).

Supported formats:

Format	Example	Description
`YYYY-MM-DD`	`2025-12-31`	Expires at midnight (00:00:00) on the specified date
`YYYY-MM-DDTHH:MM`	`2025-12-31T23:59`	Expires at the specified date and time
`YYYY-MM-DDTHH:MM:SS`	`2025-12-31T23:59:59`	Expires at the specified date, time, and seconds
RFC3339	`2025-12-31T23:59:59Z`	Expires at the specified UTC time

Dates without a timezone use the local timezone of the machine running the command. Use RFC3339 format with Z suffix or timezone offset for explicit UTC times.

Mutually exclusive with --expiry-duration.

--sts-only

Optional

Return only temporary STS credentials without creating a new permanent access key.

Global flags

This command supports any of the global flags.

Environment variables

When you specify --with-env, the command reads the AD/LDAP username from MC_LDAP_USERNAME and the AD/LDAP password from MC_LDAP_PASSWORD. Set both variables. The command ignores these variables when you omit --with-env.

Examples

Create a new access-key pair for the authenticated user

The following command creates a new access key pair to use with the currently authenticated user on the minio alias. The command outputs a randomly generated access key and secret key.

mc idp ldap accesskey create-with-login https://myaistor.example.net

Create a new access-key pair using credentials from a file

The following command reads the AD/LDAP username from the first line of /path/to/ldap-credentials.txt and the password from the second line. The command does not prompt for credentials.

mc idp ldap accesskey create-with-login https://myaistor.example.net --with-file /path/to/ldap-credentials.txt

Create a new access-key pair using credentials from environment variables

The following commands set the AD/LDAP credentials as environment variables, then create a new access key pair without prompting for credentials.

export MC_LDAP_USERNAME=LDAP_USERNAME
export MC_LDAP_PASSWORD=LDAP_PASSWORD
mc idp ldap accesskey create-with-login https://myaistor.example.net --with-env

Create a new access-key pair with a custom access key and secret key

The following command creates a new access key pair with both an access key and secret key that you specify for the user currently authenticated on the minio alias.

mc idp ldap accesskey create-with-login https://myaistor.example.net/ --access-key my-access-key-change-me --secret-key my-secret-key-change-me

Create a new access-key pair that expires after 24 hours

The following command creates a new access key pair to use with the currently authenticated user on the minio alias. The credentials expire after 24 hours.

The command outputs a randomly generated access key and secret key.

mc idp ldap accesskey create-with-login https://myaistor.example.net --expiry-duration 24h

Create a new access-key pair that expires after a date

The following command creates a new access key pair to use with the currently authenticated user on the minio alias. The credentials expire after February 28, 2025.

The command outputs a randomly generated access key and secret key.

mc idp ldap accesskey create-with-login https://myaistor.example.net --expiry 2025-02-28

Create an access key using a non-default LDAP configuration

The following command creates a new access key pair using the LDAP configuration named myldap instead of the default configuration.

mc idp ldap accesskey create-with-login https://myaistor.example.net myldap

Behavior

S3 compatibility

The mc command-line tool is built for compatibility with the AWS S3 API and is tested with MinIO AIStor and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported.

While mc commands may work as documented, any such usage is at your own risk.