minio/docs
1
0
Fork 0
mirror of https://github.com/minio/docs.git synced 2025-10-28 07:54:51 +03:00
Code Activity
Files
571f188a4eb8239fd46a1e047f2c26fdbbcdb4d6
docs/source/includes/k8s/steps-configure-ad-ldap-external-identity-management.rst
Ravind Kumar 571f188a4e Attempting to reduce docs to single platform (#1258) 
##

We are going to make the following changes to the Object Store docs as
part of a larger QC/Content pass:

### Left Navigation

We want to modify the left navigation flow to be a natural progression
from a basic setup to more advanced.

For example:

- Core Concepts
  - Deployment Architecture
  - Availability and Resiliency
  - Erasure Coding and Object Healing
  - Object Scanner
  - Site Replication and Failover
  - Thresholds and Limits
- Installation
  - Deployment Checklist
  - Deploy MinIO on Kubernetes
  - Deploy MinIO on Red Hat Linux
  - Deploy MinIO on Ubuntu Linux
  - Deploy MinIO for Development (MacOS, Windows, Container)
- Security and Encryption (Conceptual Overview)
  - Network Encryption (TLS) (Conceptual overview)
    - Enable Network Encryption using Single Domain
    - Enable Network Encryption using Multiple Domains
    - Enable Network Encryption using certmanager (Kubernetes only)
  - Data Encryption (SSE) (Conceptual overview)
    - Enable SSE using AIStor Key Management Server
    - Enable SSE using KES (Summary page + linkouts)
  - External Identity Management (Conceptual Overview)
    - Enable External Identity management using OpenID
    - Enable External Identity management using AD/LDAP
- Backup and Recovery
  - Create a Multi-Site Replication Configuration
  - Recovery after Hardware Failure
    - Recover after drive failure
    - Recover after node failure
    - Recover after site failure
- Monitoring and Alerts
  - Metrics and Alerting (v3 reference)
    - Monitoring and Alerting using Prometheus
    - Monitoring and Alerting using InfluxDB
    - Monitoring and Alerting using Grafana
    - Metrics V2 Reference
  - Publish Server and Audit Logs to External Services
  - MinIO Healthcheck API

The Administration, Developer, and Reference sections will remain as-is
for now.

http://192.241.195.202:9000/staging/singleplat/mindocs/index.html

# Goals

Maintaining multiple platforms is getting to be too much, and based on
analytics the actual number of users taking advantage of it is minimal.

Furthermore, the majority of traffic is to installation pages.

Therefore we're going to try to collapse back into a single MinIO Object
Storage product, and use simple navigation and on-page selectors to
handle Baremetal vs Kubernetes.

This may also help to eventually stage us to migrate to Hugo + Markdown

---------

Co-authored-by: Daryl White <53910321+djwfyi@users.noreply.github.com>
Co-authored-by: Rushan <rushenn@minio.io>
Co-authored-by: rushenn <rushenn123@gmail.com>
2025-07-30 12:33:02 -04:00

5.0 KiB
Raw Blame History

  1. Access the Operator Console

    Temporarily forward traffic between the local host machine and the MinIO Operator Console and retrieve the JWT token for your Operator deployment. For instructions, see Configure access to the Operator Console service <minio-k8s-deploy-operator-access-console>.

    Open your browser to the temporary URL and enter the JWT Token into the login page. You should see the Tenants page:

    MinIO Operator Console

    To deploy a new MinIO Tenant with AD/LDAP external identity management, select the + Create Tenant button.

    To configure an existing MinIO Tenant with AD/LDAP external identity management select that Tenant from the displayed list. The following steps reference the necessary sections and configuration settings for existing Tenants.

  2. Complete the Identity Provider Section

    To enable external identity management with an Active Directory / LDAP provider, select the Identity Provider section. You can then change the radio button to Active Directory to display the configuration settings.

    MinIO Operator Console - Create a Tenant - External Identity Provider Section - Active Directory / LDAP

    An asterisk * marks required fields. The following table provides general guidance for those fields:

    Field Description
    LDAP Server Address The hostname of the Active Directory or LDAP server.

    Lookup Bind DN

    The Distinguished Name MinIO uses to authenticate and query the AD/LDAP server.

    See minio-external-identity-management-ad-ldap-lookup-bind for more information.
    List of user DNs (Distinguished Names) to be Tenant Administrators Specify a user DNs (Distinguished Names) which MinIO assigns a policy <minio-policy> with administrative permissions for the Tenant. You can specify multiple DNs (Distinguished Names) by selecting the plus plus-circle icon. You can delete a DN by selecting the trash can trash icon for that DN.

    Once you complete the section, you can finish any other required sections of Tenant Deployment <minio-k8s-deploy-minio-tenant>.

  3. Assign Policies to AD/LDAP Users

    MinIO by default assigns no policies <minio-policy> to AD/LDAP users or groups. You must explicitly assign MinIO policies to a given user or group Distinguished Name (DN) to grant that user or group access to the MinIO deployment.

    The following example assumes an existing alias <alias> configured for the MinIO Tenant.

    Use the mc idp ldap policy attach command to assign a user or group DN to an existing MinIO Policy:

    mc idp ldap policy attach minio-tenant POLICY --user='uid=primary,cn=applications,dc=domain,dc=com'
mc idp ldap policy attach minio-tenant POLICY --group='cn=applications,ou=groups,dc=domain,dc=com'

    Replace POLICY with the name of the MinIO policy to assign to the user or group DN.

    See minio-external-identity-management-ad-ldap-access-control for more information on access control with AD/LDAP users and groups.

  4. Generate S3-Compatible Temporary Credentials using AD/LDAP Credentials

    Applications can use an AD/LDAP user credential to generate temporary S3-compatible credentials as-needed using the minio-sts-assumerolewithldapidentity Security Token Service (STS) API endpoint. MinIO provides an example Go application ldap.go <minio/blob/master/docs/sts/ldap.go> with an example of managing this workflow.

    POST https://minio.example.net?Action=AssumeRoleWithLDAPIdentity
&LDAPUsername=USERNAME
&LDAPPassword=PASSWORD
&Version=2011-06-15
&Policy={}

    • Replace minio.example.net with the hostname or URL for the MinIO Tenant service.

    • Replace the LDAPUsername with the username of the AD/LDAP user.

    • Replace the LDAPPassword with the password of the AD/LDAP user.

    • Replace the Policy with an inline URL-encoded JSON policy <minio-policy> that further restricts the permissions associated to the temporary credentials.

      Omit to use the policy whose name matches <minio-external-identity-management-ad-ldap-access-control> the Distinguished Name (DN) of the AD/LDAP user.

    The API response consists of an XML document containing the access key, secret key, session token, and expiration date. Applications can use the access key and secret key to access and perform operations on MinIO.

    See the minio-sts-assumerolewithldapidentity for reference documentation.