Configuring S3 Gateway

{ 
    "version": "2", 
    "fsPath": "/mapr/${cluster}/apps/s3/${node}", 
    "deploymentMode": "S3", 
    "distributedHosts": "", 
    "accessKey": "minioadmin", 
    "secretKey": "minioadmin", 
    "oldAccessKey": "", 
    "oldSecretKey": "", 
    "port": "9000", 
    "domain": "", 
    "logPath": "/opt/mapr/objectstore-client/objectstore-client-<version>/logs/minio.log", 
    "logLevel": 4, 
    "insecureSkipVerify": false, 
    "ldap": { 
        "serverAddr": "", 
        "usernameFormat": "", 
        "userDNSearchBaseDN": "", 
        "userDNSearchFilter": "", 
        "groupSearchFilter": "", 
        "groupSearchBaseDn": "", 
        "lookUpBindDN": "", 
        "lookUpBindPassword": "", 
        "stsExpiry": "", 
        "tlsSkipVerify": "", 
        "serverStartTls": "", 
        "serverInsecure": "" 
    } 
} 

{
   "fsPath":"/mapr/${cluster}/apps/s3/${node}",
   "deploymentMode":"S3",
   "accessKey":"minioadmin",
   "secretKey":"minioadmin",
   "oldAccessKey":"",
   "oldSecretKey":"",
   "port":"9000",
   "domain":"",
 "logPath":"/opt/mapr/objectstore-client/objectstore-client-2.0.0/logs/minio.log",
   "logLevel":4,
   "ldap":{
      "serverAddr":"",
      "usernameFormat":"",
      "usernameSearchFilter":"",
      "groupSearchFilter":"",
      "groupSearchBaseDn":"",
      "usernameSearchBaseDn":"",
      "groupNameAttribute":"",
      "stsExpiry":"",
      "tlsSkipVerify":"",
      "serverStartTls":"",
      "severInsecure":""
   }
}

• In distributed mode, instances of S3 gateway share user and policy information only, as well as locks between nodes.
• Distributed mode does not include proxy or load balancing in front of instances. You must configure and install proxy and load balancing manually.
• Distributed mode only works for S3 mode.
• Three or more nodes is recommended for S3 gateway in distributed mode. If only one node is active, the node will be in read-only mode.

1. Configure S3 gateway 2.1.0 or later on three or more nodes.
2. Disable caching in Fuse clients.
3. On each S3 gateway node, update the /opt/mapr/objectstore-client/objectstore-client-<version>/conf/minio.json file with the accessKey, secretKey, and ldap. The value for each of these properties must be identical across all the minio.json files.
4. On all S3 gateway 2.1.0 or later nodes, verify that the distributedHosts property contains the list of nodes with mount paths, for example:

   "distributedHosts": "http(s)://HOST1:PORT1/MOUNT_PATH1 http(s)://HOST2:PORT2/MOUNT_PATH2" 

   Note that the mount path on all nodes should target the same folder in the file system.
5. If the cluster is secure with self-signed certificates, copy the public certificates for each host to the /opt/mapr/objectstore-client/objectstore-client-<version>/conf/certs/CAs directory. To ignore validation of the certificates, set "insecureSkipVerify": true.

S3 gateway 2.1.0 and later

In S3 gateway version 2.1.0, you can only set LDAP integration in S3 mode. In S3 gateway version 2.2.0.0, you can set LDAP integration in S3 or FS mode. LDAP integration in FS mode requires that the user have a primary UID and GID. Note that you cannot assign more than one GID to a user. In FS mode, LDAP integration is handled similarly to internal users. The primary UID and GID for the LDAP user are received and injected inside the request.

"ldap": { 
"serverAddr": "localhost:389", 
"usernameFormat": "cn=%s,dc=mapr,dc=local", 
"userDNSearchBaseDN": "", 
"userDNSearchFilter": "(cn=%s)", 
"groupSearchFilter": "(&(objectclass=group)(member=%s))", 
"groupSearchBaseDn": "dc=mapr,dc=local", 
"lookUpBindDN": "", 
"lookUpBindPassword": "", 
"stsExpiry": "60h", 
"tlsSkipVerify": "on", 
"serverStartTls": "", 
"serverInsecure": "on" 
} 

S3 gateway 2.0.x

In S3 gateway version 2.0.x, only S3 mode is supported.

"ldap":{
      "serverAddr":"10.244.0.11:636",
      "usernameFormat":"uid=%s,ou=users,dc=example,dc=com",
      "usernameSearchFilter":"(uid=%s)",
      "groupSearchFilter":"",
      "groupSearchBaseDn":"ou=users,dc=example,dc=com",
      "usernameSearchBaseDn":"",
      "groupNameAttribute":"",
      "stsExpiry":"60h",
      "tlsSkipVerify":"on",
      "serverStartTls":"",
      "severInsecure":"off"
   }

LDAP Limitations

• Starting from version 2.2.0.0, S3 gateway supports S3 and FS mode. In previous versions, S3 gateway only supports S3 mode (and does not support FS mode).
• LDAP/AD integration does not work with Hadoop and Spark because the HPE Ezmeral Data Fabric implementation of Hadoop and Spark does not support sessionToken.
• In S3 gateway 2.0.0, the MINIO_IDENTITY_LDAP_SERVER_STARTTLS property is not supported, and its value in the configuration file is ignored.

mc admin user add SERVER_ALIAS USERNAME PASSWORD UID GID

/opt/mapr/bin/maprcli node services -name objectstore -nodes <node_name> -action [ start |
          restart | stop ]