Repository: minio/minio (language: go)

Issue:
LDAP - invalid login - Regression introduced some point between RELEASE.2022-07-08T00-05-23Z and RELEASE.2022-08-11T04-37-28Z
<!--- Provide a general summary of the issue in the Title above -->

## Expected Behavior
<!--- If you're describing a bug, tell us what should happen -->
<!--- If you're suggesting a change/improvement, tell us how it should work -->
Navigate to "embedded" console at configured port (9001 in this case) and enter LDAP/AD username and password to login to portal UI.

## Current Behavior
<!--- If describing a bug, tell us what happens instead of the expected behavior -->
<!--- If suggesting a change/improvement, explain the difference from current behavior -->
I'm getting a "invalid login / http 401" error response when using LDAP/AD credentials. I have to resort to root user and password to login.

## Possible Solution
<!--- Not obligatory, but suggest a fix/reason for the bug, -->
<!--- or ideas how to implement the addition or change -->

Revert docker image tag from current version with issue ***RELEASE.2022-08-11T04-37-28Z*** to last known working release ***RELEASE.2022-07-08T00-05-23Z***

## Steps to Reproduce (for bugs)
<!--- Provide a link to a live example, or an unambiguous set of steps to -->
<!--- reproduce this bug. Include code to reproduce, if relevant -->
<!--- and make sure you have followed https://github.com/minio/minio/tree/release/docs/debugging to capture relevant logs -->

1. Spin up a docker instance of minio with the image/tag version ***RELEASE.2022-07-08T00-05-23Z*** and configure ldap integration.
2. configure target LDAP/AD user with console admin access using `mc admin policy set minio consoleAdmin user="CN=John Doe,CN=Users,DC=Domain,DC=com"`
3. Confirm access using LDAP/AD target user configured above.
4. Update minio instance to latest version as of this bug report ***RELEASE.2022-08-11T04-37-28Z***
5. Test logging in to the console using the same target LDAP/AD user as confirmed above.

## Context
<!--- How has this issue affected you? What are you trying to accomplish? -->
<!--- Providing context helps us come up with a solution that is most useful in the real world -->
I'm not able to login to console to perform administrative actions

## Regression
<!-- Is this issue a regression? (Yes / No) -->
<!-- If Yes, optionally please include minio version or commit id or PR# that caused this regression, if you have these details. -->
Yes
Introduced in a release after **RELEASE.2022-07-08T00-05-23Z**, I haven't tested every single version to identify the *first* offending release.

## Your Environment

### Version used: 

`minio version RELEASE.2022-07-08T00-05-23Z`

### Operating System and version: 

`Linux lhdock01p 5.4.0-122-generic #138-Ubuntu SMP Wed Jun 22 15:00:31 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux`

### Server setup and configuration: 

```
version: "3"
services:
  minio-external:
    image: minio/minio:RELEASE.2022-07-08T00-05-23Z
    container_name: minio-external
    command: server /data /data1 /data2 /data3 --console-address :9001
    ports:
      - "9000:9000"
      - "9001:9001"
    restart: unless-stopped
    environment:
      MINIO_BROWSER_REDIRECT_URL: "https://minio.example.com"
      MINIO_DOMAIN: "blob.example.com"
      MINIO_ROOT_PASSWORD: "<root-password>"
      MINIO_ROOT_USER: "<root-user-id>"
      MINIO_SERVER_URL: "https://blob.example.com"
      MINIO_IDENTITY_LDAP_SERVER_ADDR: "Example.org:389"
      MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN: "CN=minio-ad,DC=Example,DC=com"
      MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN: "CN=Users,DC=Example,DC=com"
      MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER: "(&(sAMAccountName=%s)(memberOf=CN=Minio Users,CN=Minio,OU=Application Groups,DC=Example,DC=com))"
      MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD: "<random-password>"
      MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER: "(&(objectClass=group)(member=%d))"
      MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN: "CN=Minio,OU=Application Groups,DC=Example,DC=com"
      MINIO_IDENTITY_LDAP_SERVER_STARTTLS: "true"
      MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY: "true"
    volumes:
      - "minio_1:/data"
      - "minio_2:/data1"
      - "minio_3:/data2"
      - "minio_4:/data3"
```




Discussion / hints:
@abjoseph can you provide `mc admin trace -a --funcname sts* --funcname admin* --funcname s3*`  output?  - keep it running and attempt a login. 
Also please share server-side logs
> Yes
> Introduced in a release after **RELEASE.2022-07-08T00-05-23Z**, I haven't tested every single version to identify the _first_ offending release.

Please test `RELEASE.2022-08-08T18-34-09Z`  and let us know. 

Fix patch:
diff --git a/cmd/server-main.go b/cmd/server-main.go
index 2facf77540f1b..7394dbc9d2590 100644
--- a/cmd/server-main.go
+++ b/cmd/server-main.go
@@ -567,21 +567,24 @@ func serverMain(ctx *cli.Context) {
 		logger.LogIf(GlobalContext, err)
 	}
 
-	if globalBrowserEnabled {
-		srv, err := initConsoleServer()
-		if err != nil {
-			logger.FatalIf(err, "Unable to initialize console service")
-		}
+	// Initialize users credentials and policies in background right after config has initialized.
+	go func() {
+		globalIAMSys.Init(GlobalContext, newObject, globalEtcdClient, globalRefreshIAMInterval)
 
-		setConsoleSrv(srv)
+		// Initialize
+		if globalBrowserEnabled {
+			srv, err := initConsoleServer()
+			if err != nil {
+				logger.FatalIf(err, "Unable to initialize console service")
+			}
 
-		go func() {
-			logger.FatalIf(newConsoleServerFn().Serve(), "Unable to initialize console server")
-		}()
-	}
+			setConsoleSrv(srv)
 
-	// Initialize users credentials and policies in background right after config has initialized.
-	go globalIAMSys.Init(GlobalContext, newObject, globalEtcdClient, globalRefreshIAMInterval)
+			go func() {
+				logger.FatalIf(newConsoleServerFn().Serve(), "Unable to initialize console server")
+			}()
+		}
+	}()
 
 	// Background all other operations such as initializing bucket metadata etc.
 	go func() {
diff --git a/go.mod b/go.mod
index 5a333b720889b..dcac1a1a84f30 100644
--- a/go.mod
+++ b/go.mod
@@ -48,7 +48,7 @@ require (
 	github.com/minio/dperf v0.4.2
 	github.com/minio/highwayhash v1.0.2
 	github.com/minio/kes v0.20.0
-	github.com/minio/madmin-go v1.4.15
+	github.com/minio/madmin-go v1.4.17
 	github.com/minio/minio-go/v7 v7.0.34
 	github.com/minio/pkg v1.3.0
 	github.com/minio/selfupdate v0.5.0
diff --git a/go.sum b/go.sum
index a11a93772ca63..55eaa5215582a 100644
--- a/go.sum
+++ b/go.sum
@@ -622,8 +622,8 @@ github.com/minio/highwayhash v1.0.2/go.mod h1:BQskDq+xkJ12lmlUUi7U0M5Swg3EWR+dLT
 github.com/minio/kes v0.20.0 h1:1tyC51Rr8zTregTESuT/QN/iebNMX7B9t7d3xLNMEpE=
 github.com/minio/kes v0.20.0/go.mod h1:3FW1BQkMGQW78yhy+69tUq5bdcf5rnXJizyeKB9a/tc=
 github.com/minio/madmin-go v1.3.5/go.mod h1:vGKGboQgGIWx4DuDUaXixjlIEZOCIp6ivJkQoiVaACc=
-github.com/minio/madmin-go v1.4.15 h1:1uqNMLa2ZhU05FIxPW8bUmZ5Orbs+6Tmj5B2LFJsdRI=
-github.com/minio/madmin-go v1.4.15/go.mod h1:ez87VmMtsxP7DRxjKJKD4RDNW+nhO2QF9KSzwxBDQ98=
+github.com/minio/madmin-go v1.4.17 h1:o8b42lrJW9qyIthIa+24IzygZjmPm04iSUSBITcvzYU=
+github.com/minio/madmin-go v1.4.17/go.mod h1:ez87VmMtsxP7DRxjKJKD4RDNW+nhO2QF9KSzwxBDQ98=
 github.com/minio/mc v0.0.0-20220805080128-351d021b924b h1:ikMXncKqNE/0acH6us6yy3v+gJBP7nGv/3Rc9F7vRio=
 github.com/minio/mc v0.0.0-20220805080128-351d021b924b/go.mod h1:YUXIqqgGfFknByv0eeJSMBQl/WGuEN0XkpW68/ghBm0=
 github.com/minio/md5-simd v1.1.0/go.mod h1:XpBqgZULrMYD3R+M28PcmP0CkI7PEMzB3U77ZrKZ0Gw=


Test patch: