Identity Management Plugin Settings

This page documents settings for enabling external identity management using the MinIO Identity Management Plugin. See MinIO External Identity Management Plugin for a tutorial on using these settings.

You can establish or modify settings by defining:

• an environment variable on the host system prior to starting or restarting the AIStor Server. Refer to your operating system’s documentation for how to define an environment variable.
• a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, AIStor uses the environment variable value.

Some settings have only an environment variable or a configuration setting, but not both.

When setting up the MinIO Identity Management Plugin, you must define at a minimum all of the required settings. The examples here represent the minimum required settings.

MINIO_IDENTITY_PLUGIN_URL="https://authservice.example.net:8080/auth"
MINIO_IDENTITY_PLUGIN_ROLE_POLICY="ConsoleUser"

mc admin config set identity_plugin                  \
   url="https://external-auth.example.net:8080/auth" \
   role_policy="consoleAdmin"                        \
   [ARGUMENT=VALUE] ...

Required

The webhook endpoint for the external identity management service (https://authservice.example.net:8080/auth).

Required

Specify a comma-separated list of AIStor policies to assign to authenticated users.

Optional

Set to false to disable the identity provider configuration.

Applications cannot generate STS credentials or otherwise authenticate to AIStor using the configured provider if set to false.

Defaults to true or “enabled”.

Optional

An authentication token to present to the configured webhook endpoint.

Specify a supported HTTP Authentication scheme as a string value, such as "Bearer TOKEN". AIStor sends the token using the HTTP Authorization header.

Optional

Specify a unique ID AIStor uses to generate an ARN for this identity manager. AIStor automatically adds an idmp- prefix to the specified ID when generating the ARN.

If omitted, AIStor automatically generates the ID and prints the full ARN to the server log.

Optional

Specify a comment to associate to the identity configuration.