
###############################################################################
#
# HTCondor-CE server authorization configuration
#
###############################################################################

# These should be unnecessary, unless if we have an error below.
DENY_WRITE = anonymous@*, unmapped@*
DENY_NEGOTIATOR = anonymous@*, unmapped@*
DENY_ADMINISTRATOR = anonymous@*, unmapped@*
DENY_DAEMON = anonymous@*, unmapped@*
DENY_OWNER = anonymous@*, unmapped@*

# Defaults authorizations
FRIENDLY_DAEMONS = $(FULL_HOSTNAME)@daemon.opensciencegrid.org/$(FULL_HOSTNAME) condor@users.opensciencegrid.org/$(FULL_HOSTNAME)
# Setting the UID_DOMAIN appends @users.opensciencegrid.org to GUMS mappings.
UID_DOMAIN = users.opensciencegrid.org
USERS = *@users.opensciencegrid.org

# Unmapped users who authenticated with GSI; they are allowed to advertise
# to the collector, but that is all.
UNMAPPED_USERS = *@unmapped.opensciencegrid.org

# Authz settings for each daemon.  Preferably, change the templates above
ALLOW_WRITE = $(FRIENDLY_DAEMONS)
SCHEDD.ALLOW_WRITE = $(USERS), $(FULL_HOSTNAME)@daemon.opensciencegrid.org/$(FULL_HOSTNAME)
COLLECTOR.ALLOW_ADVERTISE_MASTER = $(FRIENDLY_DAEMONS)
COLLECTOR.ALLOW_ADVERTISE_SCHEDD = $(FRIENDLY_DAEMONS)
COLLECTOR.ALLOW_ADVERTISE_STARTD =  $(UNMAPPED_USERS)
SCHEDD.ALLOW_NEGOTIATOR = $(FULL_HOSTNAME)@daemon.opensciencegrid.org/$(FULL_HOSTNAME)
ALLOW_DAEMON = $(FRIENDLY_DAEMONS)
C_GAHP.ALLOW_DAEMON = $(ALLOW_DAEMON)
ALLOW_ADMINISTRATOR = $(FULL_HOSTNAME)@daemon.opensciencegrid.org/$(FULL_HOSTNAME)
QUEUE_SUPER_USERS = $(FULL_HOSTNAME)

# These security settings are likely unnecessary as we don't run a negotiator or
# a startd.  However, we'd prefer to see the least number of authorizations possible.
ALLOW_NEGOTIATOR = $(FULL_HOSTNAME)@daemon.opensciencegrid.org/$(FULL_HOSTNAME)
ALLOW_OWNER = $(FULL_HOSTNAME)@daemon.opensciencegrid.org/$(FULL_HOSTNAME)

# Authentication settings
SCHEDD.SEC_WRITE_AUTHENTICATION_METHODS = FS,GSI
SCHEDD.SEC_DAEMON_AUTHENTICATION_METHODS = FS,GSI

# GSI settings
GSI_DAEMON_CERT = /etc/grid-security/hostcert.pem
GSI_DAEMON_KEY  = /etc/grid-security/hostkey.pem

# Enable the audit log for the CE's activities
SCHEDD_AUDIT_LOG = $(LOG)/AuditLog
SCHEDD_DEBUG = D_AUDIT
MAX_SCHEDD_AUDIT_LOG = 1d
MAX_NUM_SCHEDD_AUDIT_LOG = 90

