CONDOR_TOKEN_CREATE(1)

📦
version 25.14.1 · 12 versions
, in fedora 43

💖 CONDOR_TOKEN_CREATE 💖

okay bestie, gather round, because we're about to talk about condor_token_create from the HTCondor Manual and honestly? it's giving ✨authentication✨. the whole vibe is: you hand it a password file, and it hands you back an authentication token for the IDTOKENS authentication method. that's the whole personality. slay.

🎀 SYNOPSIS 🎀

condor_token_create -identity user@domain [-key keyid] [-authz authz ...] [-lifetime value] [-token filename | -file filename] [-debug]

condor_token_create [-help ]

yes you have to give it an identity, no there's no way around it, that's just the rules 💅

🌸 DESCRIPTION 🌸

so here's the tea. condor_token_create goes and reads an HTCondor password file inside the SEC_PASSWORD_DIRECTORY (and by default, that's the pool password, iykyk) and uses it to create an authentication token. then that token can be used later by clients to authenticate against a remote HTCondor server. iconic.

and the why? because tokens let you do fine-grained authentication — like, actual individual HTCondor users — as opposed to pool password, where literally anything in possession of the pool password authenticates as the same user. one shared password for everyone is not the moment, bestie 😭

an identity must be specified for the token. that identity is what the client ends up as at the remote HTCondor server, no cap. and if you specify the -lifetime option, or one or more -authz options, then the token also carries additional restrictions that limit what the client is authorized to do.

⚠️ real talk, and this part matters: if an attacker is able to access the token, they will be able to authenticate with the identity listed in the token — subject to those restrictions, but still. protect your tokens like they're your phone with no case on it 🫶

if it all works out, the resulting token gets sent to stdout. but wait, there's more:

  • with the -token option, the token gets written to the user's token directory instead — and the value may not have any path information in it.
  • with the -file option, the token gets written to the given file — and there the value may be an arbitrary filename.
  • if you write it to SEC_TOKEN_SYSTEM_DIRECTORY (which defaults to /etc/condor/tokens.d), then the token can be used for daemon-to-daemon authentication. very demure, very mindful.

fyi: condor_token_create is only currently supported on Unix platforms. sorry to the Windows girlies 🦋

✨ OPTIONS ✨

  • -authz authz — adds a restriction to the token so it's only valid for a given authorization level (think READ, WRITE, DAEMON, ADVERTISE_STARTD). need multiple authorizations? then you gotta specify -authz multiple times, one per level. if -authz isn't specified at all, then no authorization restrictions get added and authorization is solely based on the token's identity. NOTE (and this is important, don't skip it): -authz cannot be used to give an identity additional permissions at the remote host. like, if the server's admin only permits the user READ authorization, then specifying -authz WRITE in a token will not let that user perform writes. the token doesn't override the admin, periodt.
  • -debug — makes debugging information get sent to stderr, based on the value of the configuration variable TOOL_DEBUG. helpful when you're like "why is this not working" 🙈
  • -help — displays brief usage information and exits. the classic.
  • -identity user@domain — sets a specific client identity to be written into the token; the client will authenticate as this identity with a remote server. this one's mandatory, bb.
  • -key keyid — specifies a key file to use under the directory specified by the SEC_PASSWORD_DIRECTORY configuration variable. the key name must match a file in the password directory, and it'll be used to sign the resulting token. the file's contents should be randomly generated and must be owned by and readable only by root 👑. if -key isn't set, then the default pool password gets used instead.
  • -lifetime value — specifies the lifetime, in seconds, for the token to be valid (and heads up: the token's validity starts when the token is signed). once the lifetime expires, the token cannot be used for authentication. if you don't specify it, the token will contain no lifetime restrictions at all.
  • -token filename — specifies a filename, relative to the directory in the SEC_TOKEN_DIRECTORY configuration variable (for example, on Linux this defaults to ~/.condor/tokens.d), where the resulting token gets stored. if you don't specify it, the token goes to stdout. (no path info allowed here, remember!)

🌈 EXAMPLES 🌈

want a token for jane@cs.wisc.edu with zero extra restrictions? say less:

$ condor_token_create -identity jane@cs.wisc.edu
eyJhbGciOiJIUzI1NiIsImtpZCI6Il....bnu3NoO9BGM

want a token for worker-node@cs.wisc.edu that can advertise either a condor_startd or a condor_master? stack those authz flags:

$ condor_token_create -identity worker-node@cs.wisc.edu \
                      -authz ADVERTISE_STARTD \
                      -authz ADVERTISE_MASTER
eyJhbGciOiJIUzI1NiIsImtpZC.....8wkstyj_OnM0SHsOdw

want a token for friend@cs.wisc.edu that's only valid for 10 minutes, saved to ~/.condor/tokens.d/friend? cute:

$ condor_token_create -identity friend@cs.wisc.edu -lifetime 600 -token friend

now for the admin girlies 👑 — if the administrator wants to create a specific key for signing tokens, token_key, distinct from the default pool password, they'd first use condor_store_cred to create the key:

$ openssl rand -base64 32 | condor_store_cred -f /etc/condor/passwords.d/token_key

note that in this case, we created a random 32 character key using SSL instead of providing a human-friendly password. no cap.

next, the administrator would run condor_token_create:

$ condor_token_create -identity frida@cs.wisc.edu -key token_key
eyJhbGciOiJIUzI1NiIsImtpZCI6I.....eyJpYXQiOUzlN6QA
🚨 and here's the lore: if the token_key file is deleted from the SEC_PASSWORD_DIRECTORY, then all of the tokens issued with that key will be invalidated. all of them. at once. 💀

💅 EXIT STATUS 💅

condor_token_create will exit with a non-zero status value if it fails to read the password file, sign the token, write the output, or experiences some other error. otherwise? it exits 0 and everything is fine. simple as that ✨

🦋 SEE ALSO 🦋

go read the whole friend group, they're all icons 🫶

👑 AUTHOR 👑

Center for High Throughput Computing, University of Wisconsin-Madison

👑 AUTHOR (yes, again, they said it twice and honestly? deserved) 👑

HTCondor Team

1990-2026, Center for High Throughput Computing, Computer Sciences Department, University of Wisconsin-Madison, Madison, WI, US. Licensed under the Apache License, Version 2.0.

and that's the whole page bestie! this one came from the HTCondor Manual and is dated Oct 16, 2026 — so like, go forth and make tokens responsibly 💖✨🌸 stay safe out there, mwah!

📦 where this page comes from