{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:*"
      ],
      "Resource": [
        "arn:aws:s3:::${ldap:username}/*"
      ]
    }
  ]

export MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY=on
```

### Variable substitution in configuration strings

In the configuration variables, `%s` is substituted with the _username_ from the STS request and `%d` is substituted with the _distinguished username (user DN)_ of the LDAP user. Please see the following table for which configuration variables support these substitution variables:

	CodeChallengeMethodsSupported    []string `json:"code_challenge_methods_supported,omitempty"`
}

// User represents information about user.
type User struct {
	Name    string `json:"username"`
	ID      string `json:"id"`
	Enabled bool   `json:"enabled"`
}

// Standard errors.
var (
	ErrNotImplemented     = errors.New("function not implemented")

      "Resource": [
        "arn:aws:s3:::*"
      ]
    }
  ]
}
```

### Visit <http://localhost:8080>

You will be redirected to dex login screen - click "Login with email", enter username password
> username: ******@****.***
> password: password

and then click "Grant access"

On the browser now you shall see the list of buckets output, along with your temporary credentials obtained from MinIO.

```
{

			Value: cfg.QueueDir,
		},
		config.KV{
			Key:   target.ElasticQueueLimit,
			Value: strconv.Itoa(int(cfg.QueueLimit)),
		},
		config.KV{
			Key:   target.ElasticUsername,
			Value: cfg.Username,
		},
		config.KV{
			Key:   target.ElasticPassword,
			Value: cfg.Password,
		},
	}

	return nil
}

// SetNotifyRedis - helper for config migration from older config.

staticPasswords:
  - email: "******@****.***"
    # bcrypt hash of the string "password"
    hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
    username: "admin"

| [**AD/LDAP**](https://github.com/minio/minio/blob/master/docs/sts/ldap.md)             | Let AD/LDAP users request temporary credentials using AD/LDAP username and password.                                                          |

"s3:GetBucketLocation" # - "s3:ListBucket" # - "s3:ListBucketMultipartU" ## conditionsexample policy creates all access to example bucket with aws:username="johndoe" and source ip range 10.0.0.0/8 and 192.168.0.0/24 only # - name: conditionsexample # statements: # - resources: # - 'arn:aws:s3:::example/*' # actions: # - 's3:*' # conditions: # - StringEquals: '"aws:username": "johndoe"' # - IpAddress: | # "aws:SourceIp": [ # "10.0.0.0/8", # "192.168.0.0/24" # ] # ## Additional Annotations for the Kubernetes...

"s3:GetBucketLocation" # - "s3:ListBucket" # - "s3:ListBucketMultipartU" ## conditionsexample policy creates all access to example bucket with aws:username="johndoe" and source ip range 10.0.0.0/8 and 192.168.0.0/24 only # - name: conditionsexample # statements: # - resources: # - 'arn:aws:s3:::example/*' # actions: # - 's3:*' # conditions: # - StringEquals: '"aws:username": "johndoe"' # - IpAddress: | # "aws:SourceIp": [ # "10.0.0.0/8", # "192.168.0.0/24" # ] # ## Additional Annotations for the Kubernetes...

"s3:GetBucketLocation" # - "s3:ListBucket" # - "s3:ListBucketMultipartU" ## conditionsexample policy creates all access to example bucket with aws:username="johndoe" and source ip range 10.0.0.0/8 and 192.168.0.0/24 only # - name: conditionsexample # statements: # - resources: # - 'arn:aws:s3:::example/*' # actions: # - 's3:*' # conditions: # - StringEquals: '"aws:username": "johndoe"' # - IpAddress: | # "aws:SourceIp": [ # "10.0.0.0/8", # "192.168.0.0/24" # ] # ## Additional Annotations for the Kubernetes...