}

// Check to allow access to the reserved "bucket" `/minio` for Admin
// API requests.
func isAdminReq(r *http.Request) bool {
	return strings.HasPrefix(r.URL.Path, adminPathPrefix)
}

// Check to allow access to the reserved "bucket" `/minio` for KMS
// API requests.
func isKMSReq(r *http.Request) bool {
	return strings.HasPrefix(r.URL.Path, kmsPathPrefix)
}

// Supported Amz date headers.

}

// List of some generic middlewares which are applied for all incoming requests.
var globalMiddlewares = []mux.MiddlewareFunc{
	// set x-amz-request-id header and others
	addCustomHeadersMiddleware,
	// The generic tracer needs to be the first middleware to catch all requests
	// returned early by any other middleware (but after the middleware that
	// sets the amz request id).
	httpTracerMiddleware,

          "expr": "sum by (bucket,api) (increase(minio_bucket_requests_inflight_total{job=\"$scrape_jobs\"}[$__rate_interval]))",
          "interval": "1m",
          "intervalFactor": 2,
          "legendFormat": "{{bucket,api}}",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeRegions": [],
      "title": "Inflight Requests Rate",
      "tooltip": {
        "shared": true,

          "exemplar": true,
          "expr": "sum by (bucket,api) (increase(minio_bucket_requests_inflight_total{job=\"$scrape_jobs\"}[$__rate_interval]))",
          "interval": "1m",
          "intervalFactor": 2,
          "legendFormat": "{{bucket,api}}",
          "refId": "A"
        }
      ],
      "title": "Inflight Requests Rate",
      "type": "timeseries"
    },
    {
      "datasource": {

		"Total number of invalid requests", "type")

	apiRequestsWaitingTotalMD = NewGaugeMD(apiRequestsWaitingTotal,
		"Total number of requests in the waiting queue", "type")
	apiRequestsIncomingTotalMD = NewGaugeMD(apiRequestsIncomingTotal,
		"Total number of incoming requests", "type")

	apiRequestsInFlightTotalMD = NewGaugeMD(apiRequestsInFlightTotal,
		"Total number of requests currently in flight", "name", "type")

		allDriveLabels...)
	driveReadsKBPerSecMD = NewGaugeMD(driveReadsKBPerSec,
		"Kilobytes read per second on a drive",
		allDriveLabels...)
	driveReadsAwaitMD = NewGaugeMD(driveReadsAwait,
		"Average time for read requests served on a drive",
		allDriveLabels...)
	driveWritesPerSecMD = NewGaugeMD(driveWritesPerSec,
		"Writes per second on a drive",
		allDriveLabels...)
	driveWritesKBPerSecMD = NewGaugeMD(driveWritesKBPerSec,

          "expr": "minio_cluster_replication_proxied_head_requests_total{job=\"$scrape_jobs\"}",
          "interval": "1m",
          "intervalFactor": 2,
          "legendFormat": "{{instance}}",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeRegions": [],
      "title": "Total Proxied Head Requests",
      "tooltip": {
        "shared": true,
        "sort": 2,

@app.route('/oauth2/callback')
def callback():
    error = request.args.get('error', '')
    if error:
        return "Error: " + error

    authorization_code = request.args.get('code')

    data = {'grant_type': 'authorization_code',
            'code': authorization_code, 'redirect_uri': callback_uri}
    id_token_response = requests.post(
        token_url, data=data, verify=False,

OPA is a lightweight general-purpose policy engine that can be co-located with MinIO server, in this document we talk about how to use OPA HTTP API to authorize requests. It can be used with any type of credentials (STS based like OpenID or LDAP, regular IAM users or service accounts).

OPA is enabled through MinIO's Access Management Plugin feature.

## Get started

	xhttp "github.com/minio/minio/internal/http"
	"github.com/minio/minio/internal/kms"
)

const unavailable = "offline"

// ClusterCheckHandler returns if the server is ready for requests.
func ClusterCheckHandler(w http.ResponseWriter, r *http.Request) {
	ctx := newContext(r, w, "ClusterCheckHandler")

	objLayer := newObjectLayerFn()
	if objLayer == nil {
		w.Header().Set(xhttp.MinIOServerStatus, unavailable)