CONDOR_TOKEN_FETCH(1)

📦
version 25.14.1 · 12 versions
, in fedora 43

💖 CONDOR_TOKEN_FETCH 💖

okay bestie, so you know that HTCondor Manual everyone's always whispering about? yeah. this page is literally condor_token_fetch, and it's about obtaining a token from a remote daemon for the IDTOKENS authentication method. iconic behavior, no cap.

✨ NAME ✨

condor_token_fetch — obtain a token from a remote daemon for the IDTOKENS authentication method 🎀

🌸 SYNOPSIS 🌸

condor_token_fetch [-authz authz ...] [-lifetime value] [-pool
pool_name] [-name hostname] [-type type] [-token filename | -file
filename] [-key signing_key]

condor_token_fetch [-help ]

🦋 DESCRIPTION 🦋

So condor_token_fetch is gonna go and try to snag an authentication token from a remote daemon. and if it works? the identity baked into that token is literally the same as the client's identity at the remote daemon. same energy, same you. 💅

Authentication tokens are such a vibe for limiting an identity's authorization, or for setting up an alternate authentication method when you're in your "new era" mood. like, say an administrator wants to use condor_token_fetch to make a token for a monitoring host that's locked to only the READ authorization. slay, restrictive, love that for them. and a user could run condor_token_fetch while they're logged in to a submit host, then take the resulting token and submit remotely from their personal laptop. main character remote-work arc. 💻✨

if you pass -lifetime or one (or more) -authz options, the token will carry extra restrictions that limit what the client is actually allowed to do. boundaries!! periodt. 🫶

by default, condor_token_fetch queries the local condor_schedd. but if you mix and match -pool, -name, or -type, the tool can request tokens from other pools, from other hosts, or from different daemon types. globetrotting.

if it all works out, the resulting token gets sent to stdout. with the -token option, it goes to the user's token directory instead (and psst — that value may not have any path information). with the -file option, it gets written to the given file (and that value may be an arbitrary filename). choose your destiny. ⭐

👑 OPTIONS 👑

  • -authz authz — adds a restriction to the token so it's only valid for a given authorization level (like READ, WRITE, DAEMON, ADVERTISE_STARTD). need multiple authorizations? then you gotta pass -authz multiple times, bestie. if you don't pass -authz, no authorization restrictions get added, and authorization is solely based on the token's identity. NOTE that -authz absolutely cannot be used to give an identity additional permissions at the remote host. so if the server's admin only permits the user READ authorization, then specifying -authz WRITE in a token will not let that user perform writes. it's giving wishful thinking, and it will not work. 💀
  • -debug — causes debugging information to be sent to stderr, based on the value of the configuration variable TOOL_DEBUG.
  • -help — display brief usage information and exit. short, sweet, helpful. 🙈
  • -lifetime value — specify the lifetime, in seconds, for the token to be valid (the token validity starts when the token is signed). once the lifetime expires, the token can't be used for authentication anymore. if not specified, the token will contain no lifetime restrictions at all. live free. 🌈
  • -name hostname — request a token from the daemon named hostname in the pool. if not specified, the locally-running daemons will be used. 🔥
  • -pool pool_name — request a token from a daemon in a non-default pool pool_name.
  • -token filename — specifies a filename, relative to the directory in the SEC_TOKEN_DIRECTORY configuration variable (defaulting to ~/.condor/tokens.d), where the resulting token is stored. if not specified, the token will be sent to stdout. 💖
  • -type type — request a token from a specific daemon type type. if not given, a condor_schedd is used.
  • -key signing_key — request a token signed by the signing key named signing_key. if not given, the daemon's default key will be used. 🔑

🎀 EXAMPLES 🎀

want a token with a lifetime of 10 minutes from the default condor_schedd? say less:

$ condor_token_fetch -lifetime 600
eyJhbGciOiJIUzI1NiIsImtpZCI6IlBPT0wifQ.eyJpYX...ii7lAfCA

want to request a token from bird.cs.wisc.edu that's limited to READ and WRITE? obsessed:

$ condor_token_fetch -name bird.cs.wisc.edu \
                      -authz READ -authz WRITE
eyJhbGciOiJIUzI1NiIsImtpZCI6IlBPT0wifQ.eyJpYX...lJTj54

want to create a token from the collector in the htcondor.cs.wisc.edu pool and then save it to ~/.condor/tokens.d/friend? chef's kiss:

$ condor_token_fetch -identity friend@cs.wisc.edu -lifetime 600 -token friend

⭐ EXIT STATUS ⭐

condor_token_fetch will exit with a non-zero status value if it fails to request or read the token. otherwise, it exits 0. we love a clean exit. 💚

🌈 SEE ALSO 🌈

condor_token_create(1), condor_token_request(1), condor_token_list(1) — go read the whole friend group, iykyk.

💜 AUTHOR 💜

Center for High Throughput Computing, University of Wisconsin-Madison

💜 AUTHOR 💜

HTCondor Team

1990-2026, Center for High Throughput Computing, Computer Sciences Department, University of Wisconsin-Madison, Madison, WI, US. Licensed under the Apache License, Version 2.0.

and that's the whole page, bestie!! go forth and fetch those tokens responsibly. this was the HTCondor Manual, dated Oct 16, 2026, and yeah — that's the CONDOR_TOKEN_FETCH(1) energy right there. bye babe, stay authenticated 💖✨🦋
📦 where this page comes from