# Require authentication and integrity checking by default.
use SECURITY : With_Authentication

# Host-based security is fine in a container environment, especially if
# we're also using a pool password or a token.
use SECURITY : Host_Based
# We also want root to be able to do reconfigs, restarts, etc.
ALLOW_ADMINISTRATOR = root@$(FULL_HOSTNAME) condor@$(FULL_HOSTNAME) $(ALLOW_ADMINISTRATOR)

# TOKEN-based auth is the preferred method starting with the HTCondor
# 8.9 series.
if version >= 8.9.7
    SEC_DEFAULT_AUTHENTICATION_METHODS = FS, IDTOKENS
else
    SEC_DEFAULT_AUTHENTICATION_METHODS = FS, TOKEN
endif

if $(USE_POOL_PASSWORD:no)
    SEC_DEFAULT_AUTHENTICATION_METHODS = $(SEC_DEFAULT_AUTHENTICATION_METHODS), PASSWORD

    ALLOW_ADVERTISE_STARTD = condor_pool@*/* $(ALLOW_ADVERTISE_STARTD)
    ALLOW_ADVERTISE_SCHEDD = condor_pool@*/* $(ALLOW_ADVERTISE_SCHEDD)
    ALLOW_ADVERTISE_MASTER = condor_pool@*/* $(ALLOW_ADVERTISE_MASTER)
endif

# Allow public reads; in this case, no need for authentication.
ALLOW_READ = *
SEC_READ_AUTHENTICATION = OPTIONAL

ALLOW_ADVERTISE_MASTER = \
    $(ALLOW_ADVERTISE_MASTER) \
    $(ALLOW_WRITE_COLLECTOR) \
    dockerworker@example.net

ALLOW_ADVERTISE_STARTD = \
    $(ALLOW_ADVERTISE_STARTD) \
    $(ALLOW_WRITE_COLLECTOR) \
    dockerworker@example.net

ALLOW_ADVERTISE_SCHEDD = \
    $(ALLOW_ADVERTISE_STARTD) \
    $(ALLOW_WRITE_COLLECTOR) \
    dockersubmit@example.net
