Refresh identity whenever token is refreshed

This patch adds three commands while allow the user to list, revoke and crucially, refresh authentication tokens from the command line.

In my use case I've edited the Salesforce YAML files to remove any authentication credentials and then changes the settings file to set this config entries from environment variables. This leaves the settings form in an invalid state so I can't use the UI to get a token since form validation fails.

The revoke and refresh commands themselves can take the machine name of the authentication provider as an argument. If no argument is given they both find the default provider and act on that.

Thanks, that's much neater :)

Thanks Aaron.

Now you've set this back to active, what more would you like me to add?

The original idea was that you can now add credentials to your settings.php file and this command would then pick them up, this seems like an alternative to the settings form.

OK. I see what you mean now and you're partially correct.

This code was added to allow for an automated deployment without including any private data in any exported code. So, on my dev machine I did what you described and added my full details to the form and got the token. This was just to allow me to then export the configuration to YAML. I edited the YAML files to remove the private data, so my consumer key in the YAML file is dummy_key for example.

I then reimported the config. Convoluted perhaps but it allows me to protect the key, user and URL by removing them from the config before I commit to git. This of course now means the form will not submit since the data in there is invalid.

But, I then add the following to settings.php

$config['salesforce.salesforce_auth.salesforce_auth']['provider_settings']['consumer_key'] = getenv('SALESFORCE_KEY');
$config['salesforce.salesforce_auth.salesforce_auth']['provider_settings']['login_user'] = getenv('SALESFORCE_LOGIN');
$config['salesforce.salesforce_auth.salesforce_auth']['provider_settings']['login_url'] = getenv('SALESFORCE_URL');

I could also replace the PEM file location, for example, depending on my environment.

Now, having done that, the form will still not work as it shows the contents of the config files, not the running settings. It's not affected by the $config changes above. The new command however, can get at these new config details and will run correctly.

So, in this way I can add dummy, invalid data to the YAML files and safely commit them to git, then have my new command pick up the correct config from the running environment and allow a deployment script to get the required access token securely.

It is a little convoluted since the token is generated in form validation, so I can't add incorrect keys to the form but I protecting those keys is exactly why I created this command.

I hope that clarifies my use case.