ReferenceAIStor Clientmc idp ldap

mc idp ldap add

The mc idp ldap add command creates an AD/LDAP IDP server configuration.

MinIO AIStor supports multiple named LDAP configurations, allowing you to integrate with different directory services or organizational units.

Syntax

The following example sets the AD/LDAP configuration settings for the myaistor deployment using the default configuration name (_).

mc idp ldap add                                                            \
            myaistor                                                       \
            server_addr=myldapserver:636                                   \
            lookup_bind_dn=cn=admin,dc=min,dc=io                           \
            lookup_bind_password=somesecret                                \
            user_dn_search_base_dn=dc=min,dc=io                            \
            user_dn_search_filter="(uid=%s)"                               \
            group_search_base_dn=ou=swengg,dc=min,dc=io                    \
            group_search_filter="(&(objectclass=groupofnames)(member=%d))"

The following example creates a named configuration called PARTNER for the MinIO AIStor cluster available at the alias myaistor:

mc idp ldap add                                                            \
            myaistor                                                       \
            PARTNER                                                        \
            server_addr=ldap2.partner.example.com:636                      \
            lookup_bind_dn=cn=admin,dc=other,dc=com                        \
            lookup_bind_password=somesecret                                \
            user_dn_search_base_dn=dc=other,dc=com                         \
            user_dn_search_filter="(uid=%s)"

The command has the following syntax:

mc [GLOBALFLAGS] idp ldap add               \
                          ALIAS             \
                          [NAME]            \
                          [CFG_PARAM1]      \
                          [CFG_PARAM2]...

  • Replace ALIAS with the alias of a MinIO AIStor deployment to create for AD/LDAP integration.

  • Replace NAME with an optional name for this LDAP configuration. If omitted, creates the default configuration at _.

  • Replace the [CFG_PARAM#] with each of the configuration setting key-value pairs in the format of PARAMETER="value".

  • Brackets [] indicate optional parameters.

  • Parameters sharing a line are mutually dependent.

  • Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

Parameters

ALIAS

Required

The alias of the MinIO AIStor deployment on which to add an AD/LDAP integration.

For example:

mc idp ldap add myaistor                               \
                server_addr=myldapserver:636          \
                lookup_bind_dn=cn=admin,dc=min,dc=io  \
                lookup_bind_password=somesecret       \
                user_dn_search_base_dn=dc=min,dc=io   \
                user_dn_search_filter="(uid=%s)"

NAME

Optional

The name of the LDAP configuration to create. If omitted, the command creates or updates the default configuration, registered internally with the name _.

Use unique names to create multiple LDAP configurations for different directory services or organizational units. The name is case-sensitive and must match exactly when referenced in other commands or environment variables. By convention, use uppercase.

For example:

mc idp ldap add myaistor PARTNER                          \
                server_addr=ldap2.partner.example.com:636 \
                lookup_bind_dn=cn=admin,dc=other,dc=com   \
                lookup_bind_password=somesecret           \
                user_dn_search_base_dn=dc=other,dc=com    \
                user_dn_search_filter="(uid=%s)"

server_addr

Required

Specify the hostname for the Active Directory / LDAP server. For example:

server_addr=ldapserver.com:636

This parameter corresponds with the MINIO_IDENTITY_LDAP_SERVER_ADDR environment variable.

lookup_bind_dn

Required

Specify the Distinguished Name (DN) for an AD/LDAP account MinIO AIStor uses when querying the AD/LDAP server. Enables Lookup-Bind authentication to the AD/LDAP server.

The DN account should be a read-only access keys with sufficient privileges to support querying performing user and group lookups.

This parameter corresponds with the MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN environment variable.

lookup_bind_password

Required

Specify the password for the Lookup-Bind user account.

MinIO AIStor redacts this value when returned as part of mc admin config get.

This parameter corresponds with the MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD environment variable.

user_dn_attributes

Optional

Comma-separated list of user DN attributes.

Some valid values include, uid,cn,mail,sshPublicKey.

To enable public authentication for LDAP users, pass sshPublicKey as a DN attribute. The user can then use the passed SSH Public Key to log in to SFTP servers.

user_dn_attributes=sshPublicKey

user_dn_search_base_dn

Required

Specify the base Distinguished Name (DN) MinIO AIStor uses when querying for user credentials matching those provided by an authenticating client.

Separate multiple DNs with a semicolon (;).

For example:

cn=miniousers,dc=myldapserver,dc=net;ou=swengg,dc=min,dc=io

Supports Lookup-Bind mode.

This parameter corresponds with the MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN environment variable.

user_dn_search_filter

Required

Specify the AD/LDAP search filter MinIO AIStor uses when querying for user credentials matching those provided by an authenticating client.

Use the %s substitution character to insert the client-specified username into the search string. For example:

user_dn_search_filter="(userPrincipalName=%s)"

This parameter corresponds with the MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER environment variable.

comment

Optional

Specify a comment to associate to the AD/LDAP configuration.

This parameter corresponds with the MINIO_IDENTITY_LDAP_COMMENT environment variable.

enabled

Optional

Set to false to disable the AD/LDAP configuration.

If false, applications cannot generate STS credentials or otherwise authenticate to MinIO AIStor using the configured provider.

Defaults to true or “enabled”.

group_search_base_dn

Optional

Specify a semicolon-separated (;) list of group search base Distinguished Names MinIO AIStor uses when performing group lookups.

For example:

group_search_base_dn="cn=miniogroups,dc=myldapserver,dc=net;ou=swengg,dc=min,dc=io"

This parameter corresponds with the MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN environment variable.

group_search_filter

Optional

Specify an AD/LDAP search filter for performing group lookups for the authenticated user.

Use the %s substitution character to insert the client-specified username into the search string. Use the %d substitution character to insert the Distinguished Name of the client-specified username into the search string.

For example:

group_search_filter="(&(objectclass=groupOfNames)(memberUid=%s))"

This parameter corresponds with the MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER environment variable.

server_insecure

Optional

Specify on to allow unsecured (non-TLS encrypted) connections to the AD/LDAP server.

MinIO AIStor sends AD/LDAP user credentials in plain text to the AD/LDAP server, such that enabling TLS is required to prevent reading credentials over the wire. Using this option presents a security risk where any user with access to network traffic can observe the unencrypted plaintext credentials.

Defaults to off.

This parameter corresponds with the MINIO_IDENTITY_LDAP_SERVER_INSECURE environment variable.

server_starttls

Optional

Specify on to enable StartTLS connections to an AD/LDAP server.

Defaults to off

For more about StartTLS, refer to section 4.14 of the LDAP RFC 4511 specification.

This parameter corresponds with the MINIO_IDENTITY_LDAP_SERVER_STARTTLS

srv_record_name

Optional

Specify the appropriate value to enable MinIO AIStor to select an AD/LDAP server using a DNS SRV record request.

When enabled, MinIO AIStor selects an AD/LDAP server by:

  • Constructing the target SRV record name following standard naming conventions.
  • Requesting a list of available AD/LDAP servers.
  • Choosing an appropriate target based on priority and weight.

The configuration examples below presume the AD/LDAP server address is set to example.com and the SRV record protocol is _tcp.

For SRV record names beginning with _ldap, specify _ldap. The constructed DNS SRV record name resembles the following:

srv_record_name=_ldap._tcp.example.com

For SRV record names with beginning with _ldaps, specify _ldaps. The constructed DNS SRV record name resembles the following:

srv_record_name=_ldaps._tcp.example.com

If your DNS SRV record name uses alternate service or protocol names, specify on and provide the full record name as your LDAP server address. Example: _ldapserver._specialtcp.example.com

For more about DNS SRV records, see DNS SRV Records for LDAP.

This parameter corresponds with the MINIO_IDENTITY_LDAP_SRV_RECORD_NAME environment variable.

tls_skip_verify

Optional

Specify on to trust the AD/LDAP server TLS certificates without verification. This option may be required if the AD/LDAP server TLS certificates are signed by an untrusted Certificate Authority (for example, self-signed).

Defaults to off

This parameter corresponds with the MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY environment variable.

The change takes effect after you restart the deployment:

mc admin service restart myaistor

Global flags

This command supports any of the global flags.

Behavior

S3 compatibility

This command uses a MinIO AIStor administrative API and does not work against other S3-compatible services.

mc idp ldap

Previous Page

mc idp ldap disable

Next Page

On this page

SyntaxParametersALIASNAMEserver_addrlookup_bind_dnlookup_bind_passworduser_dn_attributesuser_dn_search_base_dnuser_dn_search_filtercommentenabledgroup_search_base_dngroup_search_filterserver_insecureserver_starttlssrv_record_nametls_skip_verifyGlobal flagsBehaviorS3 compatibility