riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

feat(minio): use groups claim for OIDC auth instead of policy

Browse Source 
- Change MINIO_IDENTITY_OPENID_CLAIM_NAME from 'policy' to 'groups'
- Add MINIO_IDENTITY_OPENID_CLAIM_PREFIX (empty) to use raw group names
- Update scopes to 'openid,profile,email,groups'
- Enables Authentik group-based access (homelab-admins, minio-admins, etc)
- Users in homelab-admins group will get admin access to MinIO
This commit is contained in:
rock
2026-09-15 02:40:02 +09:00
parent 283d30b422
commit 0f854f2bfa
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/infra/minio/minio-tenant.yaml
+4 -2
View File
@@ -112,10 +112,12 @@ spec:
name: minio-oidc name: minio-oidc
key: MINIO_IDENTITY_OPENID_CLIENT_SECRET key: MINIO_IDENTITY_OPENID_CLIENT_SECRET
- name: MINIO_IDENTITY_OPENID_CLAIM_NAME - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
value: "policy" value: "groups"
- name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX
value: ""
- name: MINIO_IDENTITY_OPENID_REDIRECT_URI - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
value: "https://minio.riotpiao.com/oauth_callback" value: "https://minio.riotpiao.com/oauth_callback"
- name: MINIO_IDENTITY_OPENID_DISPLAY_NAME - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
value: "Authentik" value: "Authentik"
- name: MINIO_IDENTITY_OPENID_SCOPES - name: MINIO_IDENTITY_OPENID_SCOPES
value: "openid,profile,email,minio" value: "openid,profile,email,groups"