Validating credentials of service account using MinIO Client or API

[jsabater]

Hello everyone! First time here and cross-posting from Reddit, where I also seeked help.

On a MinIO installation (latest version as of 2024-02-14), I have a user and this user has a number of service accounts, one per customer (separate web application per customer).

I use Ansible to deploy and update the application into separate LXC containers. This playbook includes handing the MinIO service account and bucket of each customer. When creating a new customer from scratch, the service account does not exist, but it does when updating.

I would like to know whether there is a way for me to use mc admin user avcacct info (or similar) to attempt an authentication and check whether my current credentials are valid, therefore I don't need to re-create or modify the service account.

I have been browsing the documentation but I could not find it.

If mc does not support such feature, Maybe via the API? If so, how could I achieve that? I could use the "parent" user that "owns" the service account to validate myself when calling a certain method.

Thanks in advance.

[jsabater]

Anyone, please? 🙏 I just cannot believe there is no method to authenticate a user (just authenticate it, maybe return something given we are already there).

[harshavardhana]

If what you believe doesn't exist, please send a pull request. We are happy to accept sensible contributions.

[jsabater]

Thanks for your feedback, @harshavardhana. I have created a feature request.

[jsabater]

Please feel free to close this discussion once you have validated that, indeed, this would be a new feature.

[bpedersen2]

Check the docs: https://min.io/docs/minio/linux/reference/minio-mc.html#test-the-connection

[jsabater]

Unfortunately, I can't seem to make the following work:

# export MC_HOST_myalias="https://<ACCESSKEY>:<SECRETKEY>@minio1.domain.com:9000"
# mcli admin info myalias
mcli: <ERROR> Unable to get service status. Access Denied.

For reference, my list of aliases:

# mcli alias list
[..]
minio1
  URL       : https://minio1.domain.com:9000
  AccessKey : minio
  SecretKey : <password>
  API       : s3v4
  Path      : auto
[..]

What am I doing wrong?

References:

• https://min.io/docs/minio/linux/reference/minio-mc.html#test-the-connection
• https://min.io/docs/minio/linux/reference/minio-mc/minio-client-settings.html

[jsabater]

Further testing led me to notice that I can run a mcli ls command but not a mcli admin info command:

# mcli alias set myalias https://minio1.domain.com:9000 myaccesskey SECRETKEY
Added `myalias` successfully.
root@minio1:~# mcli ls myalias
[2022-11-17 15:15:08 UTC]     0B myaccesskey-media/
[2023-09-13 10:38:06 UTC]     0B myaccesskey-static/
root@minio1:~# mcli admin info myalias
mcli: <ERROR> Unable to get service status. Access Denied.

As I explained before, I had never attempted the mcli admin info command with a service account, only with a user. Am I missing some permission? This is the access policy of the service account myaccesskey:

{
 "Version": "2012-10-17",
 "Statement": [
  {
   "Effect": "Allow",
   "Action": [
    "s3:*"
   ],
   "Resource": [
    "arn:aws:s3:::myaccesskey-media/*",
    "arn:aws:s3:::myaccesskey-static/*"
   ]
  }
 ]
}

Thanks.

[jsabater]

I presume the missing permission has to be this one: admin:ServerInfo. Correct?

If so, I would have to modify all existing service accounts (access keys) and include such permission in their policy, correct? Then I would be able to use mc admin info to check whether a service account can authenticate with a set of credentials...

[jsabater]

I have tried adding the following bit to the policy of the service account I am setting the alias with:

  {
   "Effect": "Allow",
   "Action": [
    "admin:ServerInfo"
   ],
   "Resource": [
    "arn:aws:s3:::*"
   ]
  }

But I am still unable to athenticate my service account to check its credentials:

# mcli alias set myalias https://minio1.domain.com:9000 mysvcacct super-secret-password
Added `myalias` successfully.

# mcli alias list
myalias  
  URL       : https://minio1.domain.com:9000
  AccessKey : mysvcacct
  SecretKey : super-secret-password
  API       : s3v4
  Path      : auto

root@minio1:~# mcli admin info myalias
mcli: <ERROR> Unable to get service status. Access Denied.

Any hints, please? 🙏

[jsabater]

Okay, so I think I found the reason why it was not working: the service account I was setting the alias with belongs to a user.

I found out because I went to the MinIO Web Console and created a new service account from scratch (no parent user), and I added the following policy to it:

{
 "Version": "2012-10-17",
 "Statement": [
  {
   "Effect": "Allow",
   "Action": [
    "admin:ServerInfo"
   ]
  }
 ]
}

Then I followed the same procedure described in previous comments (i.e., setting the alias, then running the mcli amdin info myalias command) and it worked.

So I went to the parent user I was talking about and added the diagnostics policy to it, just to do a quick check, and it worked.

Thus my question would be, is it fine to have permissions such as that to the parent user? Am I compromising the system somehow when the service accounts used in the websites have access to admin:ServerInfo though its parent user?