### 5. Setup MinIO with OpenID configuration URL

MinIO server expects environment variable for OpenID configuration url as `MINIO_IDENTITY_OPENID_CONFIG_URL`, this environment variable takes a single entry.

```

    /**
     * Returns a filter for directories that may contain paths accepted by the given matcher.
     * The given path matcher should be an instance created by this service.
     * The path matcher returned by this method expects directory paths.
     * If that matcher returns {@code false}, then the directory will definitively not contain
     * the paths selected by the matcher given in argument to this method.

## REST API call to plugin

To verify the custom token presented in the `AssumeRoleWithCustomToken` API, MinIO makes a POST request to the configured identity management plugin endpoint and expects a response with some details as shown below:

### Request `POST` to plugin endpoint

Query parameters:

| Parameter Name | Value Type | Purpose                                                                 |

   * writing.
   *
   * [grpc]: https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md
   */
  open fun isDuplex(): Boolean = false

  /**
   * Returns true if this body expects at most one call to [writeTo] and can be transmitted
   * at most once. This is typically used when writing the request body is destructive and it is not
   * possible to recreate the request body after it has been sent.
   *

		funcs = reflect.ValueOf(v).Elem().FieldByName("fns")
	)

	for i := 0; i < funcs.Len(); i++ {
		got = append(got, getFuncName(funcs.Index(i)))
	}

	return fmt.Sprint(got) == fmt.Sprint(fnames), fmt.Sprintf("expects %v, got %v", fnames, got)
}

func getFuncName(fc interface{}) string {
	reflectValue, ok := fc.(reflect.Value)
	if !ok {
		reflectValue = reflect.ValueOf(fc)
	}

        testCoverage: TestCoverage,
        parallelization: (Int) -> ParallelizationMethod,
    ): List<SmallSubprojectBucket> {
        // splitIntoBuckets() method expects us to split large element into N elements,
        // but we want to have a single bucket with N batches.
        // As a workaround, we repeat the bucket N times, and deduplicate the result at the end

		},
	}

	for idx, r := range results {
		if result := logger.ExplainSQL(r.SQL, r.NumericRegexp, `"`, r.Vars...); result != r.Result {
			t.Errorf("Explain SQL #%v expects %v, but got %v", idx, r.Result, result)
		}
	}

It is not very popular or used nowadays.

OAuth2 doesn't specify how to encrypt the communication, it expects you to have your application served with HTTPS.

/// tip

In the section about **deployment** you will see how to set up HTTPS for free, using Traefik and Let's Encrypt.

///

## OpenID Connect { #openid-connect }

	// TODO(quasilyte): improve error message (#21860).
	VPGATHERQQ X2, (BP)(X20*2), X3  // ERROR "invalid instruction"
	VPGATHERQQ Y2, (BP)(Y20*2), Y3  // ERROR "invalid instruction"
	// YzrMulti4 expects exactly 4 registers referenced by REG_LIST.
	// TODO(quasilyte): improve error message (#21860).
	V4FMADDPS (AX), [Z0-Z4], K1, Z7  // ERROR "invalid instruction"
	V4FMADDPS (AX), [Z0-Z0], K1, Z7  // ERROR "invalid instruction"

to set it up refer to our [KMS Guide](https://github.com/minio/minio/blob/master/docs/kms/README.md).

Instead of configuring an external KMS you can start with a single key by
setting the env. variable `MINIO_KMS_SECRET_KEY`. It expects the following
format:

```sh
MINIO_KMS_SECRET_KEY=<key-name>:<base64-value>
```

First generate a 256 bit random key via:

```sh
$ cat /dev/urandom | head -c 32 | base64 -