Allow using offline token for automation purposes

[wtrocki]

When using CLI we try to do a token exchange at the login.
This prevents us from using offline tokens for login.

Some discussion happened in #326 where we have added way to use offline token but this requires manual edits in the config.

[craicoverflow]

Is this still relevant @wtrocki?

[craicoverflow]

No. The refresh token is valid for 10 hours, nothing that can be done about it,

[wtrocki]

We can use offline refresh token by hack and this issue was created to make this more official
Happy to close

[wtrocki]

@craicoverflow reopening. It will be good to get support fo offline tokens if someone wish to use them in bash scripts.

Generally user-based login is ok for most of cases but we could enable token for automation etc.
This also would resolve the problem with daily login to CLI in processes that depend on constant access to it etc.

[craicoverflow]

Sorry, I disagree. We should not sacrifice security for the convenience of not having to log in once per day. This has been a long agreed upon authentication flow, backed by an ADR and countless discussions with stakeholders. I think if you feel strongly about this you should start a discussion on mas-all.

[wtrocki]

Ok.. I will start by email then

[wtrocki]

I put some thoughts how to do it without making entire login implementation even more convoluted.

Offline tokens from OCM are issued using different clients than CLI so by default exchange with SSO will fail. Since we working on our own token page we could have more control on offlineToken creation thus token option will require minimal code on CLI. It will be just the same as skipping Auth flow.

[craicoverflow]

Thanks @wtrocki - let me know if there's anything you need from me.

[wtrocki]

After call with @craicoverflow we realized that all we need is --token option that will:

• Add token as refreshtoken to config
• Assume "cloud-services" client is used for exchange