anchor.diff:  
   MARKET_MAD_CONF = [
       NAME = "http",
  -<% if scope.lookupvar('one::version_gte_5_0') -%>
       SUNSTONE_NAME  = "HTTP server",
  -<% end -%>
       REQUIRED_ATTRS = "BASE_URL,PUBLIC_DIR",
       APP_ACTIONS = "create, delete, monitor"
   ]
   
   MARKET_MAD_CONF = [
       NAME = "s3",
  -<% if scope.lookupvar('one::version_gte_5_0') -%>
       SUNSTONE_NAME = "Amazon S3",
  -<% end -%>
       REQUIRED_ATTRS = "ACCESS_KEY_ID,SECRET_ACCESS_KEY,REGION,BUCKET",
       APP_ACTIONS = "create, delete, monitor"
   ]
  -<% end -%>
  +
  +#*******************************************************************************
  +# Authentication Driver Behavior Definition
  +#*******************************************************************************
  +# The configuration for each driver is defined in AUTH_MAD_CONF. These
  +# values must not be modified since they define the driver behavior.
  +#   name            : name of the auth driver
  +#   password_change : allow the end users to change their own password. Oneadmin
  +#                     can still change other user's passwords
  +#   driver_managed_groups : allow the driver to set the user's group even after
  +#                     user creation. In this case addgroup, delgroup and chgrp
  +#                     will be disabled, with the exception of chgrp to one of
  +#                     the groups in the list of secondary groups
  +#   max_token_time  : limit the maximum token validity, in seconds. Use -1 for
  +#                     unlimited maximum, 0 to disable login tokens
  +#*******************************************************************************
  +
  +AUTH_MAD_CONF = [
  +    NAME = "core",
  +    PASSWORD_CHANGE = "YES",
  +    DRIVER_MANAGED_GROUPS = "NO",
  +    MAX_TOKEN_TIME = "-1"
  +]
  +
  +AUTH_MAD_CONF = [
  +    NAME = "public",
  +    PASSWORD_CHANGE = "NO",
  +    DRIVER_MANAGED_GROUPS = "NO",
  +    MAX_TOKEN_TIME = "-1"
  +]
  +
  +AUTH_MAD_CONF = [
  +    NAME = "ssh",
  +    PASSWORD_CHANGE = "YES",
  +    DRIVER_MANAGED_GROUPS = "NO",
  +    MAX_TOKEN_TIME = "-1"
  +]
  +
  +AUTH_MAD_CONF = [
  +    NAME = "x509",
  +    PASSWORD_CHANGE = "NO",
  +    DRIVER_MANAGED_GROUPS = "NO",
  +    MAX_TOKEN_TIME = "-1"
  +]
  +
  +AUTH_MAD_CONF = [
  +    NAME = "ldap",
  +    PASSWORD_CHANGE = "YES",
  +    DRIVER_MANAGED_GROUPS = "YES",
  +    MAX_TOKEN_TIME = "86400"
  +]
  +
  +AUTH_MAD_CONF = [
  +    NAME = "server_cipher",
  +    PASSWORD_CHANGE = "NO",
  +    DRIVER_MANAGED_GROUPS = "NO",
  +    MAX_TOKEN_TIME = "-1"
  +]
  +
  +AUTH_MAD_CONF = [
  +    NAME = "server_x509",
  +    PASSWORD_CHANGE = "NO",
  +    DRIVER_MANAGED_GROUPS = "NO",
  +    MAX_TOKEN_TIME = "-1"
  +]
  
positive.code:   <%- end -%>
  
  <%- end -%>
  <% if scope.lookupvar('one::version_gte_5_0') -%>
  INHERIT_IMAGE_ATTR      = "DISK_TYPE"
  INHERIT_IMAGE_ATTR      = "ADAPTER_TYPE"
  <% end -%>
  
  INHERIT_VNET_ATTR       = "VLAN_TAGGED_ID"
  <% if not scope.lookupvar('one::version_gte_5_0') -%>
  INHERIT_VNET_ATTR       = "BRIDGE_OVS"
  <% end -%>
  INHERIT_VNET_ATTR       = "FILTER_IP_SPOOFING"
  INHERIT_VNET_ATTR       = "FILTER_MAC_SPOOFING"
  <% if scope.lookupvar('one::version_gte_4_14') -%>
  INHERIT_VNET_ATTR       = "MTU"
  <% end -%>
  
  #*******************************************************************************
  # Transfer Manager Driver Behavior Configuration
  
negative.code: # driver in /var/lib/one/remotes/auth, and add "default" to the 'auth'
  # parameter in the 'AUTH_MAD' section.
  #
  # SESSION_EXPIRATION_TIME: Time in seconds to keep an authenticated token as
  # valid. During this time, the driver is not used. Use 0 to disable session
  # caching
  