ContextQMD
Back to Authelia

MinIO

docs/content/integration/openid-connect/clients/minio/index.md

4.39.195.8 KB
Original Source

Tested Versions

{{% oidc-common bugs="claims-hydration" %}}

Assumptions

This example makes the following assumptions:

  • Application Root URL: https://minio.{{< sitevar name="domain" nojs="example.com" >}}/
  • Authelia Root URL: https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/
  • Client ID: minio
  • Client Secret: insecure_secret

Some of the values presented in this guide can automatically be replaced with documentation variables.

{{< sitevar-preferences >}}

Configuration

Authelia

The following YAML configuration is an example Authelia client configuration for use with MinIO which will operate with the application example:

yaml
identity_providers:
  oidc:
    ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
    ## See: https://www.authelia.com/c/oidc
    clients:
      - client_id: 'minio'
        client_name: 'MinIO'
        client_secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
        public: false
        authorization_policy: 'two_factor'
        require_pkce: false
        pkce_challenge_method: ''
        redirect_uris:
          - 'https://minio.{{< sitevar name="domain" nojs="example.com" >}}/oauth_callback'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
          - 'groups'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'

Configuration Escape Hatch

{{% oidc-escape-hatch-claims-hydration client_id="minio" %}}

Application

To configure MinIO there are two methods, using Environment Variables, or using the Web GUI.

Environment Variables

To configure MinIO to utilize Authelia as an OpenID Connect 1.0 Provider, use the following environment variables:

Standard
shell
MINIO_IDENTITY_OPENID_CONFIG_URL=https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/.well-known/openid-configuration
MINIO_IDENTITY_OPENID_CLIENT_ID=minio
MINIO_IDENTITY_OPENID_CLIENT_SECRET=insecure_secret
MINIO_IDENTITY_OPENID_SCOPES=openid,profile,email,groups
MINIO_IDENTITY_OPENID_REDIRECT_URI=https://minio.{{< sitevar name="domain" nojs="example.com" >}}/oauth_callback
MINIO_IDENTITY_OPENID_REDIRECT_URI_DYNAMIC=off
MINIO_IDENTITY_OPENID_DISPLAY_NAME=Authelia
MINIO_IDENTITY_OPENID_CLAIM_NAME=groups
MINIO_IDENTITY_OPENID_CLAIM_USERINFO=on
Docker Compose
yaml
services:
  minio:
    environment:
      MINIO_IDENTITY_OPENID_CONFIG_URL: 'https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/.well-known/openid-configuration'
      MINIO_IDENTITY_OPENID_CLIENT_ID: 'minio'
      MINIO_IDENTITY_OPENID_CLIENT_SECRET: 'insecure_secret'
      MINIO_IDENTITY_OPENID_SCOPES: 'openid,profile,email,groups'
      MINIO_IDENTITY_OPENID_REDIRECT_URI: 'https://minio.{{< sitevar name="domain" nojs="example.com" >}}/oauth_callback'
      MINIO_IDENTITY_OPENID_REDIRECT_URI_DYNAMIC: 'off'
      MINIO_IDENTITY_OPENID_DISPLAY_NAME: 'Authelia'
      MINIO_IDENTITY_OPENID_CLAIM_NAME: 'groups'
      MINIO_IDENTITY_OPENID_CLAIM_USERINFO: 'on'

Web GUI

To configure MinIO to utilize Authelia as an OpenID Connect 1.0 Provider, use the following instructions:

  1. Login to MinIO
  2. On the left hand menu, go to Identity, then OpenID
  3. On the top right, click Create Configuration
  4. Configure the following options:
    • Name: authelia
    • Config URL: https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/.well-known/openid-configuration
    • Client ID: minio
    • Client Secret: insecure_secret
    • Claim Name: groups
    • Display Name: Authelia
    • Claim Prefix: Leave Empty
    • Scopes: openid,profile,email,groups
    • Redirect URI: https://minio.{{< sitevar name="domain" nojs="example.com" >}}/oauth_callback
    • Role Policy: Leave Empty
    • Claim User Info: Enabled
    • Redirect URI Dynamic: Disabled
  5. Press Save at the bottom
  6. Accept the offer of a server restart at the top
    • Refresh the page and sign out if not done so automatically
  7. Add your user to an authelia group that matches the policy name in MinIO. There are select default policies that can be used. (The group name and policy name must match.)
  8. When the login screen appears again, click the Other Authentication Methods open, then select Authelia from the list.
  9. Login

Additional Steps

You may also want to consider adding a default policy to your user groups in Authelia.

See Also