Project: MinIO (Runtime / Cloud Native Storage)
File: keycloak.md

Keycloak is an open source Identity and Access Management solution aimed at modern applications and services, this document covers configuring Keycloak identity provider support with MinIO. Configure and install keycloak server by following . For a quick installation, docker-compose reference configs are also available on the . Go to Clients Click on account Settings Change `Access Type` to `confidential`. Save Click on credentials tab Copy the `Secret` to clipboard. This value is needed for `MINIOIDENTITYOPENIDCLIENTSECRET` for MinIO. Go to Users Click on the user Attribute, add a new attribute `Key` is `policy`, `Value` is name of the `policy` on MinIO (ex: `readwrite`) Add and Save Go to Clients Click on `account` Settings, set `Valid Redirect URIs` to `*`, expand `Advanced Settings` and set `Access Token Lifespan` to `1 Hours` Save Go to Clients Click on `account` Mappers Create `Name` with any text `Mapper Type` is `User Attribute` `User Attribute` is `policy` `Token Claim Name` is `policy` `Claim JSON Type` is `string` Save Open <http://localhost:8080/auth/realms/{your-realm-name}/.well-known/openid-configuration> to verify OpenID discovery document, verify it has `authorizationendpoint` and `jwksuri` Before being able to authenticate against the Admin REST API using a clientid and a clientsecret you need to make sure the client is configured as it follows: `account` client_id is a confidential client that belongs to the realm `{realm}` `account` client_id is has Service Accounts Enabled option enabled. `account` client_id has a custom "Audience" mapper, in the Mappers section. Included Client Audience: security-admin-console Go to Roles Add new Role `admin` with Description `${role_admin}`. Add this Role into compositive role named `default-roles-{realm}` - `{realm}` should be replaced with whatever realm you created from `prerequisites` section. This role is automatically trusted in the 'Service Accounts' tab. Check that `account` client_id has the role 'admin' assigned in the "Service Account Roles" tab. After that, you will be able to obtain an idtoken for the Admin REST API using clientid and client_secret: ``` curl \ -d "clientid=<YOURCLIENT_ID>" \ -d "clientsecret=<YOURCLIENT_SECRET>" \ -d "granttype=clientcredentials" \ "http://localhost:8080/auth/realms/{realm}/protocol/openid-connect/token" ``` The result will be a JSON document. To invoke the API you need to extract the value of the access_token property. You can then invoke the API by including the value in the Authorization header of requests to the API. The following example shows how to get the details of the user with `{userid}` from `{realm}` realm: ``` curl \ -H "Authorization: Bearer

\ "http://localhost:8080/auth/admin/realms/{realm}/users/{userid}" ``` ``` export MINIOROOTUSER=minio export MINIOROOTPASSWORD=minio123 minio server /mnt/export ``` Here are all the available options to configure OpenID connect ``` mc admin config set myminio/ identity_openid KEY: identity_openid enable OpenID SSO support ARGS: config_url* (url) openid discovery document e.g. "https://accounts.google.com/.well-known/openid-configuration" client_id (string) unique public identifier for apps e.g. "292085223830.apps.googleusercontent.com" claim_name (string) JWT canned policy claim name, defaults to "policy" claim_prefix (string) JWT claim namespace prefix e.g. "customer1/" scopes (csv) Comma separated list of OpenID scopes for server, defaults to advertised scopes from discovery document e.g. "email,admin" comment (sentence) optionally add a comment to this setting ``` and ENV based options ``` mc admin config set myminio/ identity_openid --env KEY: identity_openid enable OpenID SSO support ARGS: MINIOIDENTITYOPENIDCONFIGURL* (url) openid discovery document e.g. "https://accounts.google.com/.well-known/openid-configuration" MINIOIDENTITYOPENIDCLIENTID (string) unique public identifier for apps e.g. "292085223830.apps.googleusercontent.com" MINIOIDENTITYOPENIDCLAIMNAME (string) JWT canned policy claim name, defaults to "policy" MINIOIDENTITYOPENIDCLAIMPREFIX (string) JWT claim namespace prefix e.g. "customer1/" MINIOIDENTITYOPENID_SCOPES (csv) Comma separated list of OpenID scopes for server, defaults to advertised scopes from discovery document e.g. "email,admin" MINIOIDENTITYOPENID_COMMENT (sentence) optionally add a comment to this setting ``` Set `identityopenid` config with `configurl`, `client_id` and restart MinIO ``` ~ mc admin config set myminio identityopenid configurl="http://localhost:8080/auth/realms/{your-realm-name}/.well-known/openid-configuration" client_id="account" ``` NOTE: You can configure the `scopes` parameter to restrict the OpenID scopes requested by minio to the IdP, for example, `"openid,policyroleattribute"`, being `policyroleattribute` a clientscope / clientmapper that maps a role attribute called policy to a `policy` claim returned by Keycloak Once successfully set restart the MinIO instance. ``` mc admin service restart myminio ``` Client ID can be found by clicking any of the clients listed . If you have followed the above steps docs, the default Client ID will be `account`. ``` $ go run docs/sts/web-identity.go -cid account -csec 072e7f00-4289-469c-9ab2-bbe843c7f5a8 -config-ep "http://localhost:8080/auth/realms/minio/.well-known/openid-configuration" -port 8888 2018/12/26 17:49:36 listening on http://localhost:8888/ ``` This will open the login page of keycloak, upon successful login, STS credentials along with any buckets discovered using the credentials will be printed on the screen, for example: ``` { "buckets": [ "bucket-x" ], "credentials": { "AccessKeyID": "6N2BALX7ELO827DXS3GK", "SecretAccessKey": "23JKqAD+um8ObHqzfIh+bfqwG9V8qs9tFY6MqeFR+xxx", "SessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiI2TjJCQUxYN0VMTzgyN0RYUzNHSyIsImFjciI6IjAiLCJhdWQiOiJhY2NvdW50IiwiYXV0aF90aW1lIjoxNTY5OTEwNTUyLCJhenAiOiJhY2NvdW50IiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJleHAiOjE1Njk5MTQ1NTQsImlhdCI6MTU2OTkxMDk1NCwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgxL2F1dGgvcmVhbG1zL2RlbW8iLCJqdGkiOiJkOTk4YTBlZS01NDk2LTQ4OWYtYWJlMi00ZWE5MjJiZDlhYWYiLCJuYmYiOjAsInBvbGljeSI6InJlYWR3cml0ZSIsInByZWZlcnJlZF91c2VybmFtZSI6Im5ld3VzZXIxIiwic2Vzc2lvbl9zdGF0ZSI6IjJiYTAyYTI2LWE5MTUtNDUxNC04M2M1LWE0YjgwYjc4ZTgxNyIsInN1YiI6IjY4ZmMzODVhLTA5MjItNGQyMS04N2U5LTZkZTdhYjA3Njc2NSIsInR5cCI6IklEIn0.UG-ZHgwdRnsp0gFdwChb7VlbPs-GrRNUz9EV7TggCD59qjCFAKjNrVHfOSVkKvYEMe0PvwfRKjnJl3AmBA"", "SignerType": 1 } } ``` NOTE: You can use the `-cscopes` parameter to restrict the requested scopes, for example to `"openid,policyroleattribute"`, being `policyroleattribute` a clientscope / clientmapper that maps a role attribute called policy to a `policy` claim returned by Keycloak. These credentials can now be used to perform MinIO API operations. Open MinIO URL on the browser, lets say <http://localhost:9000/> Click on `Login with SSO` User will be redirected to the Keycloak user login page, upon successful login the user will be redirected to MinIO page and logged in automatically, the user should see now the buckets and objects they have access to.