# OPA Quickstart Guide [![Slack](https://slack.minio.io/slack?type=svg)](https://slack.minio.io)

OPA is a lightweight general-purpose policy engine that can be co-located with MinIO server, in this document we talk about how to use OPA HTTP API to authorize requests. It can be used with any type of credentials (STS based like OpenID or LDAP, regular IAM users or service accounts).

OPA is enabled through MinIO's Access Management Plugin feature.

## Get started

gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=

```

## Publish MinIO events via Elasticsearch

Install [Elasticsearch](https://www.elastic.co/downloads/elasticsearch) server.

This notification target supports two formats: _namespace_ and _access_.

	if err != nil {
		return nil, err
	}
	defer xhttp.DrainBody(resp.Body)

	switch resp.StatusCode {
	case http.StatusNotFound:
		return nil, ErrKeyMissing
	case http.StatusOK:
		co := &ObjectInfo{}
		return co, co.DecodeMsg(msgp.NewReader(resp.Body))
	default:
		return nil, ErrInvalidArgument
	}
}

// Set sets the cache object info
func (c Config) Set(ci *ObjectInfo) {
	configLock.RLock()

		return 0, osErrToFileErr(err)
	}

	// additionally only purge older data at the end of the transaction of new data-dir
	// movement, this is to ensure that previous data references can co-exist for
	// any recoverability.
	if oldDstDataPath != "" {
		s.moveToTrash(oldDstDataPath, true, false)
	}

	if srcVolume != minioMetaMultipartBucket {

		return nil, nil, fmt.Errorf("failed to generate serial number: %w", err)
	}

	template := x509.Certificate{
		SerialNumber: serialNumber,
		Subject: pkix.Name{
			Organization: []string{"Acme Co"},
		},
		NotBefore: notBefore,
		NotAfter:  notAfter,

		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,