# Silo Access Management Plugin Settings

LLMS index: [llms.txt](/llms.txt)

---

<a id="minio-access-management-plugin-settings"></a>
<a id="minio-server-envvar-external-access-management-plugin"></a>

This page documents settings for enabling external authorization management using the MinIO Access Management Plugin. See [MinIO External Access Management Plugin](/administration/identity-access-management/pluggable-authorization/#minio-external-access-management-plugin) for a tutorial on using these settings.

You can establish or modify settings by defining:

- an *environment variable* on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
- a *configuration setting* using [`mc admin config set`](/reference/minio-mc-admin/mc-admin-config/#mc.admin.config.set).

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Some settings have only an environment variable or a configuration setting, but not both.

> [!WARNING]
> **Important**
>
> Each configuration setting controls fundamental MinIO behavior and functionality. MinIO **strongly recommends** testing configuration changes in a lower environment, such as DEV or QA, before applying to production.

## Examples {#examples}

When setting up the MinIO Access Management plugin, you must define at minimum all *required* settings. The examples here represent the minimum required setting.

**Environment Variables**

```shell
MINIO_POLICY_PLUGIN_URL="https://authzservice.example.net:8080/authz"
```

**Configuration Settings**

#### `policy_plugin` {#mc-conf.policy_plugin}

*mc-conf*

Use the [`mc admin config set`](/reference/minio-mc-admin/mc-admin-config/#mc.admin.config.set) command to create or update the access management plugin configuration. The `policy_plugin url` argument is required. Specify additional optional arguments as a whitespace (” “)-delimited list.

```shell
mc admin config set policy_plugin                     \
   url="https://authzservice.example.net:8080/authz"  \
   [ARGUMENT=VALUE] ...
```

## Settings {#settings}

### URL {#url}

*Required*

**Environment Variable**

##### `MINIO_POLICY_PLUGIN_URL` {#envvar.MINIO_POLICY_PLUGIN_URL}

*envvar*

**Configuration Setting**

##### `policy_plugin url` {#mc-conf.policy_plugin.url}

*mc-conf*

The webhook endpoint for the external access management service (`https://authzservice.example.net:8080/authz`).

### Auth Token {#auth-token}

*Optional*

**Environment Variable**

##### `MINIO_POLICY_PLUGIN_AUTH_TOKEN` {#envvar.MINIO_POLICY_PLUGIN_AUTH_TOKEN}

*envvar*

**Configuration Setting**

##### `policy_plugin auth_token` {#mc-conf.policy_plugin.auth_token}

*mc-conf*

An authentication token to present to the configured webhook endpoint.

Specify a supported HTTP [Authentication scheme](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#authentication_schemes) as a string value, such as `"Bearer TOKEN"`. MinIO sends the token using the HTTP [Authorization](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization) header.

### HTTP2 {#http2}

*Optional*

**Environment Variable**

##### `MINIO_POLICY_PLUGIN_ENABLE_HTTP2` {#envvar.MINIO_POLICY_PLUGIN_ENABLE_HTTP2}

*envvar*

**Configuration Setting**

##### `policy_plugin enable_http2` {#mc-conf.policy_plugin.enable_http2}

*mc-conf*

Enable experimental HTTP2 support for connecting to the configure webhook service.

Defaults to off

### Comment {#comment}

*Optional*

**Environment Variable**

##### `MINIO_POLICY_PLUGIN_COMMENT` {#envvar.MINIO_POLICY_PLUGIN_COMMENT}

*envvar*

**Configuration Setting**

##### `policy_plugin comment` {#mc-conf.policy_plugin.comment}

*mc-conf*

Specify a comment to associate to the external access management configuration.