# Active Directory / LDAP Settings

LLMS index: [llms.txt](/llms.txt)

---

<a id="active-directory-ldap-settings"></a>
<a id="minio-ldap-config-settings"></a>
<a id="minio-server-envvar-external-identity-management-ad-ldap"></a>

This page documents settings for enabling external identity management using an Active Directory or LDAP service. See [Configure MinIO for Authentication using Active Directory / LDAP](/operations/external-iam/configure-ad-ldap-external-identity-management/#minio-authenticate-using-ad-ldap-generic) for a tutorial on using these settings.

> [!WARNING]
> **Important**
>
> New in version `RELEASE.2023-05-26T23-31-54Z`:
>
> [`mc idp ldap`](/reference/minio-mc/mc-idp-ldap/#command-mc.idp.ldap) commands are preferred over using configuration settings to configure MinIO to use Active Directory or LDAP for identity management.
>
> MinIO recommends using the [`mc idp ldap`](/reference/minio-mc/mc-idp-ldap/#command-mc.idp.ldap) commands for LDAP management operations. These commands offer better validation and additional features, while providing the same settings as the `identity_ldap` configuration key. See [Configure MinIO for Authentication using Active Directory / LDAP](/operations/external-iam/configure-ad-ldap-external-identity-management/#minio-authenticate-using-ad-ldap-generic) for a tutorial on using [`mc idp ldap`](/reference/minio-mc/mc-idp-ldap/#command-mc.idp.ldap).

The `identity_ldap` configuration settings remains available for existing scripts and other tools.

You can establish or modify settings by defining:

- an *environment variable* on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
- a *configuration setting* using [`mc admin config set`](/reference/minio-mc-admin/mc-admin-config/#mc.admin.config.set).

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Some settings have only an environment variable or a configuration setting, but not both.

> [!WARNING]
> **Important**
>
> Each configuration setting controls fundamental MinIO behavior and functionality. MinIO **strongly recommends** testing configuration changes in a lower environment, such as DEV or QA, before applying to production.

## Examples {#examples}

**Environment Variable**

```shell
MINIO_IDENTITY_LDAP_SERVER_ADDR="ldapserver.com:636"
```

> [!NOTE]
> **Note**
>
> `srv_record_name` automatically identifies the port.
>
> If your AD/LDAP server uses `DNS SRV Records`, do *not* append the port number to your `server_addr` value. SRV requests automatically include port numbers when returning the list of available servers.

**Configuration Setting**

#### `identity_ldap` {#mc-conf.identity_ldap}

*mc-conf*

The following settings are required when defining LDAP using [`mc admin config set`](/reference/minio-mc-admin/mc-admin-config/#mc.admin.config.set):

- `enabled`
- `server_addr`
- `lookup_bind_dn`
- `lookup_bind_dn_password`
- `user_dn_search_base_dn`
- `user_dn_search_filter`

```shell
mc admin config set identity_ldap                        \
   enabled="true"                                        \
   server_addr="ad-ldap.example.net/"                    \
   lookup_bind_dn="cn=miniolookupuser,dc=example,dc=net" \
   lookup_bind_dn_password="userpassword"                \
   user_dn_search_base_dn="dc=example,dc=net"            \
   user_dn_search_filter="(&(objectCategory=user)(sAMAccountName=%s))"
```

## Settings {#settings}

### Server Address {#server-address}

*Required*

**Environment Variable**

##### `MINIO_IDENTITY_LDAP_SERVER_ADDR` {#envvar.MINIO_IDENTITY_LDAP_SERVER_ADDR}

*envvar*

Specify the hostname for the Active Directory / LDAP server. For example:

```shell
ldapserver.com:636
```

> [!NOTE]
> **[`srv_record_name`](/reference/minio-mc/mc-idp-ldap-add/#mc.idp.ldap.add.srv_record_name) automatically identifies the port**
>
> If your AD/LDAP server uses [`DNS SRV Records`](/reference/minio-mc/mc-idp-ldap-add/#mc.idp.ldap.add.srv_record_name), do *not* append the port number to your [`server_addr`](/reference/minio-mc/mc-idp-ldap-add/#mc.idp.ldap.add.server_addr) value. SRV requests automatically include port numbers when returning the list of available servers.

**Configuration Setting**

##### `identity_ldap server_addr` {#mc-conf.identity_ldap.server_addr}

*mc-conf*

Specify the hostname for the Active Directory / LDAP server. For example:

```shell
ldapserver.com:636
```

> [!NOTE]
> **[`srv_record_name`](/reference/minio-mc/mc-idp-ldap-add/#mc.idp.ldap.add.srv_record_name) automatically identifies the port**
>
> If your AD/LDAP server uses [`DNS SRV Records`](/reference/minio-mc/mc-idp-ldap-add/#mc.idp.ldap.add.srv_record_name), do *not* append the port number to your [`server_addr`](/reference/minio-mc/mc-idp-ldap-add/#mc.idp.ldap.add.server_addr) value. SRV requests automatically include port numbers when returning the list of available servers.

### Lookup Bind DN {#lookup-bind-dn}

*Required*

**Environment Variable**

##### `MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN` {#envvar.MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN}

*envvar*

**Configuration Setting**

##### `identity_ldap lookup_bind_dn` {#mc-conf.identity_ldap.lookup_bind_dn}

*mc-conf*

Specify the Distinguished Name (DN) for an AD/LDAP account MinIO uses when querying the AD/LDAP server. Enables [Lookup-Bind](/operations/external-iam/#minio-external-identity-management-ad-ldap-lookup-bind) authentication to the AD/LDAP server.

The DN account should be a read-only access keys with sufficient privileges to support querying performing user and group lookups.

### Lookup Bind Password {#lookup-bind-password}

*Required*

**Environment Variable**

##### `MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD` {#envvar.MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD}

*envvar*

**Configuration Setting**

##### `identity_ldap lookup_bind_password` {#mc-conf.identity_ldap.lookup_bind_password}

*mc-conf*

Specify the password for the [Lookup-Bind](/operations/external-iam/#minio-external-identity-management-ad-ldap-lookup-bind) user account.

> [!NOTE]
> **Changed: RELEASE.2023-06-23T20-26-00Z**
>
> MinIO redacts this value when returned as part of [`mc admin config get`](/reference/minio-mc-admin/mc-admin-config/#mc.admin.config.get).

### User DN Search Base DN {#user-dn-search-base-dn}

*Required*

**Environment Variable**

##### `MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN` {#envvar.MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN}

*envvar*

**Configuration Setting**

##### `identity_ldap user_dn_search_base_dn` {#mc-conf.identity_ldap.user_dn_search_base_dn}

*mc-conf*

Specify the base Distinguished Name (DN) MinIO uses when querying for user credentials matching those provided by an authenticating client.

Separate multiple DNs with a semicolon (`;`).

For example:

```shell
cn=miniousers,dc=myldapserver,dc=net;ou=swengg,dc=min,dc=io
```

Supports [Lookup-Bind](/operations/external-iam/#minio-external-identity-management-ad-ldap-lookup-bind) mode.

### User DN Search Filter {#user-dn-search-filter}

*Required*

**Environment Variable**

##### `MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER` {#envvar.MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER}

*envvar*

**Configuration Setting**

##### `identity_ldap user_dn_search_filter` {#mc-conf.identity_ldap.user_dn_search_filter}

*mc-conf*

Specify the AD/LDAP search filter MinIO uses when querying for user credentials matching those provided by an authenticating client.

Use the `%s` substitution character to insert the client-specified username into the search string. For example:

```shell
(userPrincipalName=%s)
```

### User DN Attributes {#user-dn-attributes}

*Optional*

**Environment Variable**

##### `MINIO_IDENTITY_LDAP_USER_DN_ATTRIBUTES` {#envvar.MINIO_IDENTITY_LDAP_USER_DN_ATTRIBUTES}

*envvar*

**Configuration Setting**

##### `identity_ldap user_dn_attributes` {#mc-conf.identity_ldap.user_dn_attributes}

*mc-conf*

> [!NOTE]
> **Added: RELEASE.2024-06-06T09-36-42Z**

Comma-separated list of user DN attributes.

Some valid values include, `uid,cn,mail,sshPublicKey`.

To enable public authentication for LDAP users, pass `sshPublicKey` as a DN attribute. The user can then use the passed SSH Public Key to log in to SFTP servers.

```text
mc idp ldap update ALIAS user_dn_attributes=sshPublicKey
```

### Enabled {#enabled}

*Optional*

**Environment Variable**

This setting does not have an environment variable option. Use the configuration setting instead.

**Configuration Setting**

##### `identity_ldap enabled` {#mc-conf.identity_ldap.enabled}

*mc-conf*

Set to `false` to disable the AD/LDAP configuration.

If `false`, applications cannot generate STS credentials or otherwise authenticate to MinIO using the configured provider.

Defaults to `true` or “enabled”.

### Group Search Filter {#group-search-filter}

*Optional*

**Environment Variable**

##### `MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER` {#envvar.MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER}

*envvar*

**Configuration Setting**

##### `identity_ldap group_search_filter` {#mc-conf.identity_ldap.group_search_filter}

*mc-conf*

Specify an AD/LDAP search filter for performing group lookups for the authenticated user

Use the `%s` substitution character to insert the client-specified username into the search string. Use the `%d` substitution character to insert the Distinguished Name of the client-specified username into the search string.

For example:

```shell
(&(objectclass=groupOfNames)(memberUid=%s))
```

When providing an AD/LDAP group search filter, configure a filter that returns the minimum number of relevant groups for the purpose of supporting authentication. Filters that return large group assignments increase the size of associated calls and resources. Functions sensitive to large request or response bodies may exhibit unexpected behaviors as a result.

When providing an AD/LDAP group search filter, configure a filter that returns the minimum number of relevant groups for the purpose of supporting authentication. Filters that return large group assignments increase the size of associated calls and resources. Functions sensitive to large request or response bodies may exhibit unexpected behaviors as a result.

### Group Search Base DN {#group-search-base-dn}

*Optional*

**Environment Variable**

##### `MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN` {#envvar.MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN}

*envvar*

**Configuration Setting**

##### `identity_ldap group_search_base_dn` {#mc-conf.identity_ldap.group_search_base_dn}

*mc-conf*

Specify a semicolon-separated (`;`) list of group search base [Distinguished Names](https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ldap/distinguished-names) MinIO uses when performing group lookups.

For example:

```shell
cn=miniogroups,dc=myldapserver,dc=net;ou=swengg,dc=min,dc=io
```

### TLS Skip Verify {#tls-skip-verify}

*Optional*

**Environment Variable**

##### `MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY` {#envvar.MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY}

*envvar*

**Configuration Setting**

##### `identity_ldap tls_skip_verify` {#mc-conf.identity_ldap.tls_skip_verify}

*mc-conf*

Specify `on` to trust the AD/LDAP server TLS certificates without verification. This option may be required if the AD/LDAP server TLS certificates are signed by an untrusted Certificate Authority (e.g. self-signed).

Defaults to `off`

### Server Insecure {#server-insecure}

*Optional*

**Environment Variable**

##### `MINIO_IDENTITY_LDAP_SERVER_INSECURE` {#envvar.MINIO_IDENTITY_LDAP_SERVER_INSECURE}

*envvar*

**Configuration Setting**

##### `identity_ldap server_insecure` {#mc-conf.identity_ldap.server_insecure}

*mc-conf*

Specify `on` to allow unsecured (non-TLS encrypted) connections to the AD/LDAP server.

MinIO sends AD/LDAP user credentials in plain text to the AD/LDAP server, such that enabling TLS is *required* to prevent reading credentials over the wire. Using this option presents a security risk where any user with access to network traffic can observe the unencrypted plaintext credentials.

Defaults to `off`.

### Server Start TLS {#server-start-tls}

*Optional*

**Environment Variable**

##### `MINIO_IDENTITY_LDAP_SERVER_STARTTLS` {#envvar.MINIO_IDENTITY_LDAP_SERVER_STARTTLS}

*envvar*

**Configuration Setting**

##### `identity_ldap server_starttls` {#mc-conf.identity_ldap.server_starttls}

*mc-conf*

Specify `on` to enable `StartTLS` connections to an AD/LDAP server.

Defaults to `off`

For more about `StartTLS`, refer to section 4.14 of the [LDAP RFC 4511 specification](https://docs.ldap.com/specs/rfc4511.txt).

### SRV Record Name {#srv-record-name}

*Optional*

> [!NOTE]
> **Added: RELEASE.2022-12-12T19-27-27Z**

**Environment Variable**

##### `MINIO_IDENTITY_LDAP_SRV_RECORD_NAME` {#envvar.MINIO_IDENTITY_LDAP_SRV_RECORD_NAME}

*envvar*

**Configuration Setting**

##### `identity_ldap srv_record_name` {#mc-conf.identity_ldap.srv_record_name}

*mc-conf*

Specify the appropriate value to enable MinIO to select an AD/LDAP server using a [DNS SRV record](https://ldap.com/dns-srv-records-for-ldap) request.

When enabled, MinIO selects an AD/LDAP server by:

- Constructing the target SRV record name following standard naming conventions.
- Requesting a list of available AD/LDAP servers.
- Choosing an appropriate target based on priority and weight.

The configuration examples below presume the AD/LDAP server address is set to `example.com` and the SRV record protocol is `_tcp`.

For SRV record names beginning with `_ldap`, specify `ldap`. The constructed DNS SRV record name resembles the following:

```shell
_ldap._tcp.example.com
```

For SRV record names with beginning with `_ldaps`, specify `ldaps`. The constructed DNS SRV record name resembles the following:

```shell
_ldaps._tcp.example.com
```

If your DNS SRV record name uses alternate service or protocol names, specify `on` and provide the full record name as your LDAP server address. Example: `_ldapserver._specialtcp.example.com`

For more about DNS SRV records, see [DNS SRV Records for LDAP](https://ldap.com/dns-srv-records-for-ldap).

> [!NOTE]
> **Server address for DNS SRV record configurations**
>
> The specified server name **must not** include a port number. This is different from a standard AD/LDAP configuration, where the port number is required.
>
> See [`server_addr`](#mc-conf.identity_ldap.server_addr) or [`MINIO_IDENTITY_LDAP_SERVER_ADDR`](#envvar.MINIO_IDENTITY_LDAP_SERVER_ADDR) for more about configuring an AD/LDAP server address.

### Comment {#comment}

*Optional*

**Environment Variable**

##### `MINIO_IDENTITY_LDAP_COMMENT` {#envvar.MINIO_IDENTITY_LDAP_COMMENT}

*envvar*

**Configuration Setting**

##### `identity_ldap identity_ldap comment` {#mc-conf.identity_ldap.identity_ldap.comment}

*mc-conf*

Specify a comment to associate to the AD/LDAP configuration.