Ability to generate a new GALASA_TOKEN via REST API

[Mark-J-Lawrence]

Background

We deploy our ecosystems via bluegreen. It's mostly a manual process at the moment, and an aspirational end goal would be to fully automate it.

Currently though, it is only possible to create a GALASA_TOKEN manually via the UI.

So when a new ecosystem is installed, we can't start using it fully until a user has logged into the UI and generated a new token via My Settings.

If we want automation to deploy the ecosystem and log in, this would need to be scriptable. A REST API endpoint seems most sensible?

Tasks

• <task>

[eamansour]

Looking at this closer - this unfortunately doesn't seem to be very feasible. The issue is that the OAuth flow needs a user to manually complete the auth challenge with the ecosystem's configured identity provider (e.g. GitHub, GitLab, LDAP, etc.) in a browser. That would mean a script would have to fill in the fields for a login page... which isn't ideal.

For reference, this is what the existing flow looks like https://github.com/galasa-dev/galasa/blob/main/modules/framework/docs/design/authentication-design.md#when-the-web-ui-requests-a-new-personal-access-token - we would be able to simplify this slightly by having a single REST API endpoint that creates a Dex client and redirects to authenticate with it... but that would still need a user to complete the auth challenge manually.

Edit: it might be possible via OAuth2 Token Exchange, see https://dexidp.io/docs/guides/token-exchange/
Needs more investigating.