
#####################################################################################
# MANDATORY: To setup the credmon, you must uncomment this line:
use feature : OAUTH

# MANDATORY for local credmon: Uncomment these lines to have submitters always
# locally create a scitokens credential.  Job submit files then need to have
#    use_oauth_services = scitokens
# to send the credentials to the jobs,
# or a job transform should be added to the schedd config
# to always add `scitokens` to the list of `OAuthServicesNeeded`.
#
# LOCAL_CREDMON_PROVIDER_NAMES = scitokens

# MANDATORY for local credmon if using the default scitoken:2.0 version tokens
# Audience (aud) claim that should be set in a locally issued token.
# The audience is a shared value between the token issuer and the service
# verifying the token. It is a space-separated list, will be converted to a JSON
# list object in the token.
# LOCAL_CREDMON_TOKEN_AUDIENCE = https://example.com https://anotherserver.edu

# MANDATORY for enabling the transfer of credentials from submit host
# to execute hosts, if encryption is not already enabled.
# SEC_DEFAULT_ENCRYPTION = REQUIRED

# MANDATORY when requiring users to use the Vault credmon by default
# Tell condor_submit to route token requests through htgettoken
# SEC_CREDENTIAL_STORER = /usr/bin/condor_vault_storer

# Set the time in seconds that credd will wait after jobs are
# finished before deleting the user's credential directory. Don't
# set this lower than 7 days because condor_vault_storer only stores
# credentials in credd once a week.
# SEC_CREDENTIAL_SWEEP_DELAY = 604800

#####################################################################################
#
# OPTIONAL: These are customized in many use cases.
#
#

# Path to the local issuer private keyfile
# LOCAL_CREDMON_PRIVATE_KEY = /etc/condor/scitokens-private.pem

# The local issuer URL; relying parties will need to be able to access this
# issuer URL to download the corresponding public key.
# LOCAL_CREDMON_ISSUER = https://$(FULL_HOSTNAME)

# Each key must have a name that relying parties can look up; defaults to "local"
# LOCAL_CREDMON_KEY_ID = local

# The lifetime, in seconds, for a new token.  The credmon will continuously renew
# credentials on the submit-side.
# LOCAL_CREDMON_TOKEN_LIFETIME = 1200

# The authorizations given to the token.  Should be of the form `authz:path` and
# space-separated for multiple authorizations.  The token `{username}` will be
# expanded with the user's Unix username.
# LOCAL_CREDMON_AUTHZ_TEMPLATE = read:/user/{username} write:/user/{username}

# Additional group authorizations given to the token.  Should be of the form
# `authz:path` and space-separated for multiple authorizations.  For each group
# that the user belongs to in the mapfile (see LOCAL_CREDMON_AUTHZ_GROUP_MAPFILE
# below), this scope will be added with the token `{groupname}` expanded with the
# group name.
# LOCAL_CREDMON_AUTHZ_GROUP_TEMPLATE = read:/groups/{groupname} write:/groups/{groupname}

# The user-to-group(s) mapfile that should be used for expanding groupnames.
# This is required if using LOCAL_CREDMON_AUTHZ_GROUP_TEMPLATE. The format closely
# follows that of CLASSAD_USER_MAPFILE_<name> mapfiles, though the first token
# on each line must be "*". Invalid lines are ignored. For example, a valid line for
# a user named submituser might look like:
# * submituser      groupA,groupB,groupC
# This user would then have LOCAL_CREDMON_AUTHZ_GROUP_TEMPLATE appended three times
# (once per group) to their token's scope.
# LOCAL_CREDMON_AUTHZ_GROUP_MAPFILE = /etc/condor/local_credmon_group_map

#####################################################################################
#
#
# OPTIONAL: These are rarely customized
#
#

# Should the local issuer credmon write access tokens as JSON files (default)
# LOCAL_CREDMON_TOKEN_USE_JSON = true
# or as bare strings (LOCAL_CREDMON_TOKEN_USE_JSON = false)
# LOCAL_CREDMON_TOKEN_USE_JSON = false

# Version (ver) claim that should be set in a locally issued token
# Default: scitoken:2.0
# LOCAL_CREDMON_TOKEN_VERSION = scitoken:2.0

# Override the location of the credential directory, credmon daemon, or credmon log
# SEC_CREDENTIAL_DIRECTORY_OAUTH = /var/lib/condor/oauth_credentials
# CREDMON_OAUTH_LOG = $(LOG)/CredMonOAuthLog
# CREDMON_OAUTH = /usr/sbin/condor_credmon_oauth

## These settings only apply to credentials fetched by Vault
## Set the minimum time in seconds that access tokens must have
## before they expire when they are fetched by credmon. It must
## be set to be less than the expiration time assigned by the token
## issuer.
CREDMON_OAUTH_TOKEN_MINIMUM = 2400
## Set the time in seconds between fetching new access tokens.
## If not set, the default is half of CREDMON_OAUTH_TOKEN_MINIMUM.
CREDMON_OAUTH_TOKEN_REFRESH = 1200
