Identity and Access Management on SILO

User Management

Mon, 01 Jan 0001 00:00:00 +0000

Overview

A MinIO user consists of a unique access key (username) and corresponding secret key (password). Clients must authenticate their identity by specifying both a valid access key (username) and the corresponding secret key (password) of an existing MinIO user.

Each user can have one or more assigned policies that explicitly list the actions and resources to which that user has access. Users can also inherit policies from the groups in which they have membership.

Group Management

Mon, 01 Jan 0001 00:00:00 +0000

Overview

A group is a collection of users. Each group can have one or more assigned policies that explicitly list the actions and resources to which group members are allowed or denied access.

For example, consider the following groups. Each group is assigned a built-in policy or supported policy action. Each group also has one or more assigned users. Each user’s total set of permissions consists of their explicitly assigned permission and the inherited permissions from each of their assigned groups. MinIO by default denies access to any resource or operation not explicitly allowed by a user’s assigned or inherited policies.

OpenID Connect Access Management

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports using an OpenID Connect (OIDC) compatible IDentity Provider (IDP) such as Okta, KeyCloak, Dex, Google, or Facebook for external management of user identities.

For identities managed by the external OpenID Connect (OIDC) compatible provider, MinIO can use either of two methods to assign policies to the authenticated user.

Use the JSON Web Token claim returned as part of the OIDC authentication flow to identify the policies to assign to the authenticated user.
Use the RoleArn specified in the authorization request to assign the policies attached to the provider’s RolePolicy.

MinIO by default denies access to all actions or resources not explicitly allowed by a user’s assigned or inherited policies. Users managed by an OIDC provider must specify the necessary policies as part of the JWT claim. If the user JWT claim has no matching MinIO policies, that user has no permissions to access any action or resource on the MinIO deployment.

Active Directory / LDAP Access Management

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports configuring a single Active Directory or LDAP (AD/LDAP) service for external management of user identities. Enabling AD/LDAP external identity management disables the MinIO internal IDP.

For identities managed by the external AD/LDAP provider, MinIO uses the user’s Distinguished Name and attempts to map it against an existing policy.

If the AD/LDAP configuration includes the necessary settings to query the user’s AD/LDAP group membership, MinIO also uses those group Distinguished Names and attempts to map each against an existing policy.

MinIO External Identity Management Plugin

Mon, 01 Jan 0001 00:00:00 +0000

Overview

The MinIO Identity Management Plugin provides a REST interface for offloading authentication to an external identity manager through a webhook service.

Once enabled, client applications use the AssumeRoleWithCustomToken STS API extension to generate access tokens for MinIO. MinIO verifies this token by making a POST request to the configured plugin endpoint and uses the returned response to determine the authentication status of the client.

Configuration Settings

You can configure the MinIO Identity Management Plugin using the following environment variables or configuration settings:

Access Management

Mon, 01 Jan 0001 00:00:00 +0000

Overview

MinIO uses Policy-Based Access Control (PBAC) to define the authorized actions and resources to which an authenticated user has access. Each policy describes one or more actions and conditions that outline the permissions of a user or group of users.

MinIO PBAC is built for compatibility with AWS IAM policy syntax, structure, and behavior. The MinIO documentation makes a best-effort to cover IAM-specific behavior and functionality. Consider deferring to the IAM documentation for more complete documentation on AWS IAM-specific topics.

MinIO External Access Management Plugin

Mon, 01 Jan 0001 00:00:00 +0000

Overview

The MinIO Access Management Plugin provides a REST interface for offloading authorization through a webhook service.

Once enabled, MinIO sends the request and credential details for every API call to the configured external HTTP(S) endpoint and looks for a response of ALLOW or DENY. MinIO can therefore delegate the access management to the external system instead of relying on S3 policy based access control.

Configuration Settings

You can configure the MinIO External Access Management Plugin using the following environment variables or configuration settings.