storj.io/minio@v0.0.0-20230509071714-0cbc90f649b1/docs/sts/dex.md (about)

     1  # Dex Quickstart Guide [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)
     2  
     3  Dex is an identity service that uses OpenID Connect to drive authentication for apps. Dex acts as a portal to other identity providers through "connectors." This lets dex defer authentication to LDAP servers, SAML providers, or established identity providers like GitHub, Google, and Active Directory. Clients write their authentication logic once to talk to dex, then dex handles the protocols for a given backend.
     4  
     5  ## Prerequisites
     6  
     7  Install Dex by following [Dex Getting Started Guide](https://dexidp.io/docs/getting-started/)
     8  
     9  ### Start Dex
    10  
    11  ```
    12  ~ ./bin/dex serve dex.yaml
    13  time="2020-07-12T20:45:50Z" level=info msg="config issuer: http://127.0.0.1:5556/dex"
    14  time="2020-07-12T20:45:50Z" level=info msg="config storage: sqlite3"
    15  time="2020-07-12T20:45:50Z" level=info msg="config static client: Example App"
    16  time="2020-07-12T20:45:50Z" level=info msg="config connector: mock"
    17  time="2020-07-12T20:45:50Z" level=info msg="config connector: local passwords enabled"
    18  time="2020-07-12T20:45:50Z" level=info msg="config response types accepted: [code token id_token]"
    19  time="2020-07-12T20:45:50Z" level=info msg="config using password grant connector: local"
    20  time="2020-07-12T20:45:50Z" level=info msg="config signing keys expire after: 3h0m0s"
    21  time="2020-07-12T20:45:50Z" level=info msg="config id tokens valid for: 3h0m0s"
    22  time="2020-07-12T20:45:50Z" level=info msg="listening (http) on 0.0.0.0:5556"
    23  ```
    24  
    25  ### Configure MinIO server with Dex
    26  ```
    27  ~ export MINIO_IDENTITY_OPENID_CLAIM_NAME=name
    28  ~ export MINIO_IDENTITY_OPENID_CONFIG_URL=http://127.0.0.1:5556/dex/.well-known/openid-configuration
    29  ~ minio server ~/test
    30  ```
    31  
    32  ### Run the `web-identity.go`
    33  
    34  ```
    35  ~ go run web-identity.go -cid example-app -csec ZXhhbXBsZS1hcHAtc2VjcmV0 \
    36       -config-ep http://127.0.0.1:5556/dex/.well-known/openid-configuration \
    37       -cscopes groups,openid,email,profile
    38  ```
    39  
    40  ```
    41  ~ mc admin policy add admin allaccess.json
    42  ```
    43  
    44  Contents of `allaccess.json`
    45  ```json
    46  {
    47    "Version": "2012-10-17",
    48    "Statement": [
    49      {
    50        "Effect": "Allow",
    51        "Action": [
    52          "s3:*"
    53        ],
    54        "Resource": [
    55          "arn:aws:s3:::*"
    56        ]
    57      }
    58    ]
    59  }
    60  ```
    61  
    62  ### Visit http://localhost:8080
    63  You will be redirected to dex login screen - click "Login with email", enter username password
    64  > username: admin@example.com
    65  > password: password
    66  
    67  and then click "Grant access"
    68  
    69  On the browser now you shall see the list of buckets output, along with your temporary credentials obtained from MinIO.
    70  ```
    71  {
    72  	"buckets": [
    73  		"dl.minio.equipment",
    74  		"dl.minio.service-fulfillment",
    75  		"testbucket"
    76  	],
    77  	"credentials": {
    78  		"AccessKeyID": "Q31CVS1PSCJ4OTK2YVEM",
    79  		"SecretAccessKey": "rmDEOKARqKYmEyjWGhmhLpzcncyu7Jf8aZ9bjDic",
    80  		"SessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJRMzFDVlMxUFNDSjRPVEsyWVZFTSIsImF0X2hhc2giOiI4amItZFE2OXRtZEVueUZaMUttNWhnIiwiYXVkIjoiZXhhbXBsZS1hcHAiLCJlbWFpbCI6ImFkbWluQGV4YW1wbGUuY29tIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsImV4cCI6IjE1OTQ2MDAxODIiLCJpYXQiOjE1OTQ1ODkzODQsImlzcyI6Imh0dHA6Ly8xMjcuMC4wLjE6NTU1Ni9kZXgiLCJuYW1lIjoiYWRtaW4iLCJzdWIiOiJDaVF3T0dFNE5qZzBZaTFrWWpnNExUUmlOek10T1RCaE9TMHpZMlF4TmpZeFpqVTBOallTQld4dlkyRnMifQ.nrbzIJz99Om7TvJ04jnSTmhvlM7aR9hMM1Aqjp2ONJ1UKYCvegBLrTu6cYR968_OpmnAGJ8vkd7sIjUjtR4zbw",
    81  		"SignerType": 1
    82  	}
    83  }
    84  ```
    85  
    86  Now you have successfully configured Dex IdP with MinIO.
    87  
    88  > NOTE: Dex supports groups with external connectors so you can use `groups` as policy claim instead of `name`.
    89  ```
    90  export MINIO_IDENTITY_OPENID_CLAIM_NAME=groups
    91  ```
    92  
    93  and add relevant policies on MinIO using `mc admin policy add myminio/ <group_name> group-access.json`
    94  
    95  ## Explore Further
    96  
    97  - [MinIO STS Quickstart Guide](https://docs.min.io/docs/minio-sts-quickstart-guide)
    98  - [The MinIO documentation website](https://docs.min.io)