
#####################################################################################
# MANDATORY: To setup the credmon, you must uncomment these lines:
#
DAEMON_LIST = $(DAEMON_LIST) CREDD CREDMON_OAUTH

# MANDATORY for OAuth credmon on HTCondor < 8.9.2: Uncomment this
# line to have the CredD use the OAuth2 mode of managing credentials
#
if version < 8.9.2
  CREDD_OAUTH_MODE = True
endif

# MANDATORY for enabling the transfer of credentials from submit host
# to execute hosts, if encryption is not already enabled.
SEC_DEFAULT_ENCRYPTION = REQUIRED

#####################################################################################
#
#
# OPTIONAL: These are rarely customized
#
#

# Common directories and definition of the various credmon-related daemons
SEC_CREDENTIAL_DIRECTORY_OAUTH = /var/lib/condor/oauth_credentials
TRUST_CREDENTIAL_DIRECTORY = True
CREDMON_OAUTH = /usr/sbin/condor_credmon_vault
SEC_CREDENTIAL_STORER = /usr/bin/condor_vault_storer
SEC_CREDENTIAL_MONITOR_OAUTH_LOG = $(LOG)/CredMonOAuthLog

# This is the minimum time in seconds that access tokens must have 
#   before they expire when they are fetched by credmon.  It must
#   be set to be less than the expiration time assigned by the token
#   issuer.
CREDMON_OAUTH_TOKEN_MINIMUM=2400
# This is the time in seconds between fetching new access tokens.
#   If not set, the default is half of CREDMON_OATH_TOKEN_MINIMUM.
CREDMON_OAUTH_TOKEN_REFRESH=1200
# This is the time in seconds that credd will wait after jobs are
#   finished before deleting the user's credential directory.  Don't
#   set this lower than 7 days because condor_vault_storer only stores
#   credentials in credd once a week.
SEC_CREDENTIAL_SWEEP_DELAY=604800

# Prior to version 8.9.7, OAUTH parameters were not set separately
if version < 8.9.7
   SEC_CREDENTIAL_DIRECTORY = $(SEC_CREDENTIAL_DIRECTORY_OAUTH)
   SEC_CREDENTIAL_MONITOR_LOG = $(SEC_CREDENTIAL_MONITOR_OAUTH_LOG)
endif
