Active Directory / LDAP Access Management

Authentication and Authorization Flow

The login flow for an application using Active Directory / LDAP credentials is as follows:

1. Specify the AD/LDAP credentials to the MinIO Security Token Service (STS) AssumeRoleWithLDAPIdentity API endpoint.

2. MinIO verifies the provided credentials against the AD/LDAP server.

3. MinIO checks for any policy whose name matches the user Distinguished Name (DN) and assigns that policy to the authenticated user.

   If configured to perform group queries, MinIO also queries for a list of AD/LDAP groups in which the user has membership. MinIO checks for any policy whose name matches a returned group DN and assigns that policy to the authenticated user.

4. MinIO returns temporary credentials in the STS API response in the form of an access key, secret key, and session token. The credentials have permissions matching those policies whose name matches either the authenticated user DN or a group DN.

MinIO provides an example Go application ldap.go that handles the full login flow.

AD/LDAP users can alternatively create access keys associated to their AD/LDAP user Distinguished Name. Access Keys are long-lived credentials which inherit their privileges from the parent user. The parent user can further restrict those privileges while creating the access keys. Use either of the following methods to create a new access keys:

• Log into the MinIO Console using the AD/LDAP-managed user credentials. From the Identity section of the left navigation, select Access Keys followed by the Create access keys + button.

• Use the mc admin user svcacct add command to create the access keys. Specify the user Distinguished Name as the username to which to associate the access keys.

Mapping Policies to User DN

Consider the following policy assignments:

mc admin policy set --consoleAdmin user='cn=sisko,cn=users,dc=example,dc=com'
mc admin policy set --readwrite,diagnostics user='cn=dax,cn=users,dc=example,dc=com'

• MinIO would assign an authenticated user with DN matching cn=sisko,cn=users,dc=example,dc=com the consoleAdmin policy, granting complete access to the MinIO server.

• MinIO would assign an authenticated user with DN matching cn=dax,cn=users,dc=example,dc=com both the readwrite and diagnostics policies, granting general read/write access to the MinIO server and access to diagnostic administrative operations.

• MinIO would assign no policies to an authenticated user with DN matching cn=quark,cn=users,dc=example,dc=com and deny all access to API operations.

Mapping Policies to Group DN

Consider the following policy assignments:

mc admin policy set --consoleAdmin group='cn=ops,cn=groups,dc=example,dc=com'
mc admin policy set --diagnostics group='cn=engineering,cn=groups,dc=example,dc=com'

• MinIO would assign any authenticating user with membership in the cn=ops,cn=groups,dc=example,dc=com AD/LDAP group the consoleAdmin policy, granting complete access to the MinIO server.

• MinIO would assign any authenticating user with membership in the cn=engineering,cn=groups,dc=example,dc=com AD/LDAP group the diagnostics policy, granting access to diagnostic administrative operations.