Configure Buckit for Authentication using Active Directory / LDAP

Overview

Buckit supports configuring a single Active Directory / LDAP Connect for external management of user identities.

The procedure on this page provides instructions for:

• Configuring a Buckit cluster for an external AD/LDAP provider.

• Accessing the Buckit Console using AD/LDAP credentials.

• Using the Buckit AssumeRoleWithLDAPIdentity Security Token Service (STS) API to generate temporary credentials for use by applications.

This procedure is generic for AD/LDAP services. See the documentation for the AD/LDAP provider of your choice for specific instructions or procedures on configuration of user identities.

Prerequisites

Configure Buckit with Active Directory or LDAP External Identity Management

1. Set the Active Directory / LDAP Configuration Settings

   Configure the AD/LDAP provider using one of the following:

   • Buckit Client

   • Environment variables

   All methods require starting/restarting the Buckit deployment to apply changes.

   The following tabs provide a quick reference for the available configuration methods:

   Buckit Client

   Buckit supports specifying the AD/LDAP provider settings using bm idp ldap commands.

   For distributed deployments, the bm idp ldap command applies the configuration to all nodes in the deployment.

   The following example code sets all configuration settings related to configuring an AD/LDAP provider for external identity management.

   The minimum required settings are:

   • server_addr

   • lookup_bind_dn

   • lookup_bind_password

   • user_dn_search_base_dn

   • user_dn_search_filter

   bm idp ldap add ALIAS                                                  \
     server_addr="ldaps.example.net:636"                                  \
     lookup_bind_dn="CN=xxxxx,OU=xxxxx,OU=xxxxx,DC=example,DC=net"        \
     lookup_bind_password="xxxxxxxx"                                      \
     user_dn_search_base_dn="DC=example,DC=net"                           \
     user_dn_search_filter="(&(objectCategory=user)(sAMAccountName=%s))"  \
     group_search_filter= "(&(objectClass=group)(member=%d))"             \
     group_search_base_dn="ou=Buckit Users,dc=example,dc=net"              \
     tls_skip_verify="off"                                                \
     server_insecure=off                                                  \
     server_starttls="off"                                                \
     srv_record_name=""                                                   \
     comment="Test LDAP server"
   

   For more complete documentation on these settings, see bm idp ldap.

   bm idp ldap recommended

   bm idp ldap offers additional features and improved validation over bm admin config set runtime configuration settings. bm idp ldap supports the same settings as bm admin config and the identity_ldap configuration key.

   The identity_ldap configuration key remains available for existing scripts and tools.

   Environment Variables

   Buckit supports specifying the AD/LDAP provider settings using environment variables.

   The buckit server process applies the specified settings on its next startup. For distributed deployments, specify these settings across all nodes in the deployment using the same values. Any differences in server configurations between nodes will result in startup or configuration failures.

   The following example code sets all environment variables related to configuring an AD/LDAP provider for external identity management. The minimum required variable are:

   • MINIO_IDENTITY_LDAP_SERVER_ADDR

   • MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN

   • MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD

   • MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN

   • MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER

   export MINIO_IDENTITY_LDAP_SERVER_ADDR="ldaps.example.net:636"
   export MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN="CN=xxxxx,OU=xxxxx,OU=xxxxx,DC=example,DC=net"
   export MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN="dc=example,dc=net"
   export MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER="(&(objectCategory=user)(sAMAccountName=%s))"
   export MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD="xxxxxxxxx"
   export MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER="(&(objectClass=group)(member=%d))"
   export MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN="ou=Buckit Users,dc=example,dc=net"
   export MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY="off"
   export MINIO_IDENTITY_LDAP_SERVER_INSECURE="off"
   export MINIO_IDENTITY_LDAP_SERVER_STARTTLS="off"
   export MINIO_IDENTITY_LDAP_SRV_RECORD_NAME=""
   export MINIO_IDENTITY_LDAP_COMMENT="LDAP test server"
   

   For complete documentation on these variables, see Active Directory / LDAP Settings.

2. Restart the Buckit Deployment

   You must restart the Buckit deployment to apply the configuration changes.

   If you configured AD/LDAP from the Buckit Console, no additional action is required. The Buckit Console automatically restarts the deployment after saving the new AD/LDAP configuration.

   For Buckit Client and environment variable configuration, use the bm admin service restart command to restart the deployment:

   bm admin service restart ALIAS
   

   Replace ALIAS with the alias of the deployment to restart.

3. Use the Buckit Console to Log In with AD/LDAP Credentials

   The Buckit Console supports the full workflow of authenticating to the AD/LDAP provider, generating temporary credentials using the Buckit AssumeRoleWithLDAPIdentity Security Token Service (STS) endpoint, and logging the user into the Buckit deployment.

   You can access the Console by opening the root URL for the Buckit cluster. For example, https://buckit.example.net:9000.

   Once logged in, you can perform any action for which the authenticated user is authorized.

   You can also create access keys for supporting applications which must perform operations on Buckit. Access Keys are long-lived credentials which inherit their privileges from the parent user. The parent user can further restrict those privileges while creating the service account.

4. Generate S3-Compatible Temporary Credentials using AD/LDAP Credentials

   Buckit requires clients to authenticate using AWS Signature Version 4 protocol with support for the deprecated Signature Version 2 protocol. Specifically, clients must present a valid access key and secret key to access any S3 or Buckit administrative API, such as PUT, GET, and DELETE operations.

   Applications can generate temporary access credentials as-needed using the AssumeRoleWithLDAPIdentity Security Token Service (STS) API endpoint and AD/LDAP user credentials. Buckit provides an example Go application ldap.go that manages this workflow.

   POST https://buckit.example.net?Action=AssumeRoleWithLDAPIdentity
   &LDAPUsername=USERNAME
   &LDAPPassword=PASSWORD
   &Version=2011-06-15
   &Policy={}
   

   • Replace the LDAPUsername with the username of the AD/LDAP user.

   • Replace the LDAPPassword with the password of the AD/LDAP user.

   • Replace the Policy with an inline URL-encoded JSON policy that further restricts the permissions associated to the temporary credentials.

     Omit to use the policy whose name matches the Distinguished Name (DN) of the AD/LDAP user.

   The API response consists of an XML document containing the access key, secret key, session token, and expiration date. Applications can use the access key and secret key to access and perform operations on Buckit.

   See the AssumeRoleWithLDAPIdentity for reference documentation.

Disable a Configured Active Directory / LDAP Connection

You can enable and disable the configured AD/LDAP connection as needed.

Use bm idp ldap disable to deactivate a configured connection. Use bm idp ldap enable to activate a previously configured connection.