# Silo Identity Management Plugin Settings

LLMS index: [llms.txt](/llms.txt)

---

<a id="minio-identity-management-plugin-settings"></a>
<a id="minio-server-envvar-external-identity-management-plugin"></a>

This page documents settings for enabling external identity management using the MinIO Identity Management Plugin. See [MinIO External Identity Management Plugin](/administration/identity-access-management/pluggable-authentication/#minio-external-identity-management-plugin) for a tutorial on using these settings.

You can establish or modify settings by defining:

- an *environment variable* on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
- a *configuration setting* using [`mc admin config set`](/reference/minio-mc-admin/mc-admin-config/#mc.admin.config.set).

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Some settings have only an environment variable or a configuration setting, but not both.

> [!WARNING]
> **Important**
>
> Each configuration setting controls fundamental MinIO behavior and functionality. MinIO **strongly recommends** testing configuration changes in a lower environment, such as DEV or QA, before applying to production.

## Examples {#examples}

When setting up the MinIO Identity Management Plugin, you must define at a minimum all of the *required* settings. The examples here represent the minimum required settings.

**Environment Variables**

```shell
MINIO_IDENTITY_PLUGIN_URL="https://authservice.example.net:8080/auth"
MINIO_IDENTITY_PLUGIN_ROLE_POLICY="ConsoleUser"
```

**Configuration Settings**

#### `identity_plugin` {#mc-conf.identity_plugin}

*mc-conf*

Use [`mc admin config set`](/reference/minio-mc-admin/mc-admin-config/#mc.admin.config.set) to create or update the identity plugin configuration. The `identity_plugin url` argument is required. Specify additional optional arguments as a whitespace (” “)-delimited list.

```shell
mc admin config set identity_plugin                  \
   url="https://external-auth.example.net:8080/auth" \
   role_policy="consoleAdmin"                        \
   [ARGUMENT=VALUE] ...
```

## Settings {#settings}

### URL {#url}

*Required*

**Environment Variable**

##### `MINIO_IDENTITY_PLUGIN_URL` {#envvar.MINIO_IDENTITY_PLUGIN_URL}

*envvar*

**Configuration Setting**

##### `identity_plugin url` {#mc-conf.identity_plugin.url}

*mc-conf*

The webhook endpoint for the external identity management service (`https://authservice.example.net:8080/auth`).

### Role Policy {#role-policy}

*Required*

**Environment Variable**

##### `MINIO_IDENTITY_PLUGIN_ROLE_POLICY` {#envvar.MINIO_IDENTITY_PLUGIN_ROLE_POLICY}

*envvar*

**Configuration Setting**

##### `identity_plugin role_policy` {#mc-conf.identity_plugin.role_policy}

*mc-conf*

Specify a comma-separated list of MinIO [policies](/administration/identity-access-management/policy-based-access-control/#minio-policy) to assign to authenticated users.

### Enable {#enable}

*Optional*

**Environment Variable**

This setting does not have an environment variable option.

**Configuration Setting**

##### `identity_plugin enabled` {#mc-conf.identity_plugin.enabled}

*mc-conf*

Set to `false` to disable the identity provider configuration.

Applications cannot generate STS credentials or otherwise authenticate to MinIO using the configured provider if set to `false`.

Defaults to `true` or “enabled”.

### Token {#token}

*Optional*

**Environment Variable**

##### `MINIO_IDENTITY_PLUGIN_TOKEN` {#envvar.MINIO_IDENTITY_PLUGIN_TOKEN}

*envvar*

**Configuration Setting**

##### `identity_plugin token` {#mc-conf.identity_plugin.token}

*mc-conf*

An authentication token to present to the configured webhook endpoint.

Specify a supported HTTP [Authentication scheme](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#authentication_schemes) as a string value, such as `"Bearer TOKEN"`. MinIO sends the token using the HTTP [Authorization](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization) header.

### Role ID {#role-id}

*Optional*

**Environment Variable**

##### `MINIO_IDENTITY_PLUGIN_ROLE_ID` {#envvar.MINIO_IDENTITY_PLUGIN_ROLE_ID}

*envvar*

**Configuration Setting**

##### `identity_plugin role_id` {#mc-conf.identity_plugin.role_id}

*mc-conf*

Specify a unique ID MinIO uses to generate an ARN for this identity manager. MinIO automatically adds an `idmp-` prefix to the specified ID when generating the ARN.

If omitted, MinIO automatically generates the ID and prints the full ARN to the server log.

### Comment {#comment}

*Optional*

**Environment Variable**

##### `MINIO_IDENTITY_PLUGIN_COMMENT` {#envvar.MINIO_IDENTITY_PLUGIN_COMMENT}

*envvar*

**Configuration Setting**

##### `identity_plugin comment` {#mc-conf.identity_plugin.comment}

*mc-conf*

Specify a comment to associate to the identity configuration.