S3 Minio SDK Connection Test - False Error

[korshakov]

• Duplicati version: Duplicati - 2.0.7.1_beta_2023-05-25
• Operating system: Windows 11
• Backend: S3 Minio SDK

Description

S3 Minio SDK Connection test at destination part of new backup creation will throw permission error, however if you ignore this and run the backup it will all work just fine.

Steps to reproduce

1. Choose S3 Compatible (Minio SDK) as your destination.
2. USE SSL Ticked
3. Enter your custom server URL (without https://)
4. Enter your bucket name
5. Enter your custom Region
6. Storage Class Default
7. Folder Path empty or whatever folder path you wish it doesn't matter
8. Enter your AWS ID and Secret
9. Library to use Minio SDK
10. Hit Test Connection
11. The bucket name should start with your username, prepend automatically? NO
    Error: Failed to connect: MinIO API responded with message=Access denied on the resource: test/

• Actual result:
  Error: Failed to connect: MinIO API responded with message=Access denied on the resource: test/

• Expected result:
  Should say connection successful.

[ts678]

Access denied on the resource: test/

Was the resource shown typed by you? If so, where, and how exactly?

Library to use Minio SDK

Is there a reason for this choice? I think there was talk of updating it, but I don't think it happened. I don't know whole history.

What is your S3 compatible provider?

Hit Test Connection

This is typically a list operation, but done differently, somehow. Maybe a different code route is taken to reach the backend?
Possibly this relates to your false error, but it might have to wait for a developer who knows the area well. Meanwhile, does the Verify files button work OK? You can also do manual experiments with Export As Command-line and using the URL to run Duplicati.CommandLine.BackendTool.exe or (after editing URL into an empty folder) Duplicati.CommandLine.BackendTester.exe.

[korshakov]

Was the resource shown typed by you? If so, where, and how exactly?

Yes its the bucket name called test.

Is there a reason for this choice? I think there was talk of updating it, but I don't think it happened. I don't know whole history.

I believe I need to be able to specify custom region. So yes

What is your S3 compatible provider?

My own Minio Servers, other backup clients like restic, duplicacy or kopia works just fine so its nothing my S3 server where the issue is i believe.

[ts678]

I believe I need to be able to specify custom region.

This seems to at least available in the config GUI for Amazon AWS SDK. I'm guessing that the GUI field corresponds to option:

s3-location-constraint

This option is only used when creating new buckets. Use this option to change what region the data is stored in.

I rarely use S3, never specify a custom region, and don't have Minio server, so can't test, but the only other case of this may be

Storage Class Error @S3 Compatible #4803 which looks different, apart from the error message. There are various Minio issues. Possibly that's why there was once a plan to try SDK update. The former dev who did that might even have offered a test build.

Although I'm not at all confident this will help, Windows 11 enables TLS 1.3 by default, and that sometimes causes problems, so allowed-ssl-versions set to avoid it (e.g. use Tls12) helps. There were also prior tests suggested, if you wish to narrow it down.

I'm glad that it doesn't seem disruptive, but that probably also makes it less likely that one of the scarce developers will jump in.

[kenkendk]

@korshakov I don't think Minio uses the custom region. As stated by @ts678 this is an option that is used by AWS to specify where the buckets are created, in case they do not already exist. When using Minio, you point to the storage, and the bucket is (presumably) already created.

@korshakov Can you see in the Minio logs any errors that would hint to why one fails and the other does not?

The backup starts with listing the remote contents, so the command issued should be the same for both test & backup.
If you have --no-remote-verification=true, I could understand that writing the files works, but listing the folder before it is created does not work.

In case you want to try testing different cases, you can copy the connection string, and then use the same connection string with the Duplicati.CommandLine.BackendTester.exe tool that gives you direct access to the operations Duplicati can perform, so you can try variations on the list command.