mc idp ldap accesskey create

The mc idp ldap accesskey create allows you to add LDAP access key pairs.

Syntax

The following example creates a new access key pair with the same policy as the authenticated user on the myaistor alias:

mc idp ldap accesskey create myaistor

The command has the following syntax:

mc [GLOBALFLAGS] idp ldap accesskey create                   \
                                 ALIAS[:CONFIG_NAME]         \
                                 [USER]                      \
                                 [--access-key <value>]      \
                                 [--secret-key <value>]      \
                                 [--policy <value>]          \
                                 [--name <value>]            \
                                 [--description <value>]     \
                                 [--expiry <value>]          \
                                 [--expiry-duration <value>]

Replace ALIAS with the alias of a MinIO AIStor deployment configured for AD/LDAP integration.
Optionally append :CONFIG_NAME to specify a non-default LDAP configuration.
Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

Parameters

ALIAS[:CONFIG_NAME]

Required

The alias of the MinIO AIStor deployment configured for AD/LDAP.

Optionally append :CONFIG_NAME to use a non-default LDAP configuration. If not specified, the command uses the default LDAP configuration.

USER

Optional

The user for whom to create the accesskey. If not specified, the accesskey is generated for the authenticated LDAP user.

If a user is not specified and the current user is not authenticated with LDAP, the command returns an error.

--access-key

Optional

An access key to use for the account. The access key cannot contain the characters = (equal sign) or , (comma).

Requires --secret-key

--secret-key

Optional

A secret to use for the account.

Requires --access-key

--policy

Optional

File path to the JSON-formatted policy to use for the account.

If not specified, the account uses the same policy as the authenticated user.

--name

Optional

A human-readable name to use for the account.

--description

Optional

Add a description for the service account. For example, you might specify the reason the access key exists.

--expiry-duration

Optional

Length of time the access key pair remains valid for use.

Specify the length as one or more number-unit pairs, such as 24h, 2w, or 5d12h30s. Valid units are ns (nanoseconds), us or µs (microseconds), ms (milliseconds), s (seconds), m (minutes), h (hours), d (days), w (weeks), and y (years).

mc counts one day as 24 hours, one week as 7 days, and one year as 365 days.

Mutually exclusive with --expiry.

--expiry

Optional

The future date and time when the access key expires. The access key becomes invalid at the start of the specified date and time (midnight if no time is specified).

Supported formats:

Format	Example	Description
`YYYY-MM-DD`	`2030-12-31`	Expires at midnight (00:00:00) on the specified date
`YYYY-MM-DDTHH:MM`	`2030-12-31T23:59`	Expires at the specified date and time
`YYYY-MM-DDTHH:MM:SS`	`2030-12-31T23:59:59`	Expires at the specified date, time, and seconds
RFC3339	`2030-12-31T23:59:59Z`	Expires at the specified UTC time

Dates without a timezone use the local timezone of the machine running the command. Use RFC3339 format with Z suffix or timezone offset for explicit UTC times.

Mutually exclusive with --expiry-duration.

Global flags

This command supports any of the global flags.

Examples

Logged in user

Most of the examples here do not specify a user. This results in the command generating access keys for the current user that is authenticated with LDAP.

If no user is specified and the current user is not authenticated with LDAP, the commands return an error.

To create an accesskey for yourself when you are not currently authenticated with LDAP, use mc idp ldap accesskey create-with-login instead.

Create a new access-key pair for the authenticated LDAP user

The following command creates a new access key pair to use with the currently authenticated LDAP user on the myaistor alias. The command outputs a randomly generated access key and secret key.

mc idp ldap accesskey create myaistor

If the current user is not authenticated with LDAP, the command returns an error.

Create a new access-key pair with a custom access key and secret key

The following command creates a new access key pair with both an access key and secret key that you specify for the user currently authenticated on the myaistor alias.

mc idp ldap accesskey create myaistor/ --access-key my-access-key-change-me --secret-key my-secret-key-change-me

Create a new access-key pair that expires after 24 hours

The following command creates a new access key pair to use with the currently authenticated user on the myaistor alias. The credentials expire after 24 hours.

The command outputs a randomly generated access key and secret key.

mc idp ldap accesskey create myaistor --expiry-duration 24h

The following command creates a new access key pair. The AIStor Client will first ask you to log in as the user the access key is for on the MinIO AIStor site configured for LDAP at myaistor.example.com.

The command outputs a randomly generated access key and secret key.

mc idp ldap accesskey create myaistor --login myaistor.example.com

Create a new access-key pair that expires after a date

The following command creates a new access key pair to use with the currently authenticated user on the myaistor alias. The credentials expire after February 28, 2027.

The command outputs a randomly generated access key and secret key.

mc idp ldap accesskey create myaistor --expiry 2027-02-28

Create a new access-key pair for a specified user

The following command creates a new access key pair for use by the user aistor-user on the aistor alias. The credentials expire after 24 hours.

mc idp ldap accesskey create aistor/ aistor-user --expiry-duration 24h

Create an access key using a non-default LDAP configuration

The following command creates a new access key pair using the LDAP configuration named myldap instead of the default configuration.

mc idp ldap accesskey create myaistor:myldap

Behavior

S3 compatibility

This command uses a MinIO AIStor administrative API and does not work against other S3-compatible services.

mc idp ldap accesskey create

On this page