44
55# AuthSettings (from diracx.core.settings)
66# OAuth2 client identifier for DIRAC services.
7- #
7+ #
88# This should match the client ID registered with the identity provider.
99# DIRACX_SERVICE_AUTH_DIRAC_CLIENT_ID=myDIRACClientID
1010
1111# List of allowed redirect URLs for OAuth2 authorization flow.
12- #
12+ #
1313# These URLs must be pre-registered and should match the redirect URIs
1414# configured in the OAuth2 client registration.
1515# Example: ["http://localhost:8000/docs/oauth2-redirect"]
1616# DIRACX_SERVICE_AUTH_ALLOWED_REDIRECTS=[]
1717
1818# Expiration time in seconds for device flow authorization requests.
19- #
19+ #
2020# After this time, the device code becomes invalid and users must restart
2121# the device flow process. Default: 10 minutes.
2222# DIRACX_SERVICE_AUTH_DEVICE_FLOW_EXPIRATION_SECONDS=600
2323
2424# Expiration time in seconds for authorization code flow.
25- #
25+ #
2626# The time window during which the authorization code remains valid
2727# before it must be exchanged for tokens. Default: 5 minutes.
2828# DIRACX_SERVICE_AUTH_AUTHORIZATION_FLOW_EXPIRATION_SECONDS=300
2929
3030# Encryption key used to encrypt/decrypt the state parameter passed to the IAM.
31- #
31+ #
3232# This key ensures the integrity and confidentiality of state information
3333# during OAuth2 flows. Must be a valid Fernet key.
3434DIRACX_SERVICE_AUTH_STATE_KEY =
3535
3636# The issuer identifier for JWT tokens.
37- #
37+ #
3838# This should be a URI that uniquely identifies the token issuer and
3939# matches the 'iss' claim in issued JWT tokens.
4040DIRACX_SERVICE_AUTH_TOKEN_ISSUER =
4141
4242# Keystore containing the cryptographic keys used for signing JWT tokens.
43- #
43+ #
4444# This includes both public and private keys for token signature
4545# generation and verification.
4646DIRACX_SERVICE_AUTH_TOKEN_KEYSTORE =
4747
4848# List of allowed cryptographic algorithms for JWT token signing.
49- #
49+ #
5050# Supported algorithms include RS256 (RSA with SHA-256) and EdDSA
5151# (Edwards-curve Digital Signature Algorithm). Default: ["RS256", "EdDSA"]
5252# DIRACX_SERVICE_AUTH_TOKEN_ALLOWED_ALGORITHMS=['RS256', 'EdDSA']
5353
5454# Expiration time in minutes for access tokens.
55- #
55+ #
5656# After this duration, access tokens become invalid and must be refreshed
5757# or re-obtained. Default: 20 minutes.
5858# DIRACX_SERVICE_AUTH_ACCESS_TOKEN_EXPIRE_MINUTES=20
5959
6060# Expiration time in minutes for refresh tokens.
61- #
61+ #
6262# The maximum lifetime of refresh tokens before they must be re-issued
6363# through a new authentication flow. Default: 60 minutes.
6464# DIRACX_SERVICE_AUTH_REFRESH_TOKEN_EXPIRE_MINUTES=60
6565
6666# Set of security properties available in this DIRAC installation.
67- #
67+ #
6868# These properties define various authorization capabilities and are used
6969# for access control decisions. Defaults to all available security properties.
7070# DIRACX_SERVICE_AUTH_AVAILABLE_PROPERTIES=
@@ -73,7 +73,7 @@ DIRACX_SERVICE_AUTH_TOKEN_KEYSTORE=
7373
7474# DevelopmentSettings (from diracx.core.settings)
7575# When set to true (only for demo/CI), crash if an access policy isn't called.
76- #
76+ #
7777# This is useful for development and testing to ensure all endpoints have proper
7878# access control policies defined.
7979# DIRACX_DEV_CRASH_ON_MISSED_ACCESS_POLICY=False
@@ -95,7 +95,7 @@ DIRACX_SERVICE_AUTH_TOKEN_KEYSTORE=
9595
9696# SandboxStoreSettings (from diracx.core.settings)
9797# Name of the S3 bucket used for storing job sandboxes.
98- #
98+ #
9999# This bucket will contain input and output sandbox files for DIRAC jobs.
100100# The bucket must exist or auto_create_bucket must be enabled.
101101DIRACX_SANDBOX_STORE_BUCKET_NAME =
@@ -107,15 +107,13 @@ DIRACX_SANDBOX_STORE_S3_CLIENT_KWARGS=
107107# DIRACX_SANDBOX_STORE_AUTO_CREATE_BUCKET=False
108108
109109# Validity duration in seconds for pre-signed S3 URLs.
110- #
110+ #
111111# This determines how long generated download/upload URLs remain valid
112112# before expiring. Default: 300 seconds (5 minutes).
113113# DIRACX_SANDBOX_STORE_URL_VALIDITY_SECONDS=300
114114
115115# Logical name of the Storage Element for the sandbox store.
116- #
116+ #
117117# This name is used within DIRAC to refer to this sandbox storage
118118# endpoint in job descriptions and file catalogs.
119119# DIRACX_SANDBOX_STORE_SE_NAME=SandboxSE
120-
121-
0 commit comments