Is your feature request related to a problem?
The secret of a confidential client cannot be read from the CLI. The server exposes GET /realms/{realm}/clients/{client_id}/client-secret (libs/ferriskey-api-client/src/handlers/get_client_secret.rs), but nothing in the CLI calls it, and ImportReport does not surface it either.
Creating a confidential client with ferris-ctl and then having to open the console to read its secret defeats every non-interactive use — CI, provisioning, bootstrapping an environment.
Desired solution
ferris-ctl client secret <client_id> [--realm <realm>]
printing the raw secret on stdout so it can be piped or captured, with the surrounding output kept on stderr.
ImportReport should also carry the secret of every confidential client it created, so an import is self-sufficient.
Since reading a secret is an audited operation server-side, the command should be explicit about that rather than hiding it behind client get.
Environment
ferris-ctl 0.2.3, FerrisKey server 0.7.0
Is your feature request related to a problem?
The secret of a confidential client cannot be read from the CLI. The server exposes
GET /realms/{realm}/clients/{client_id}/client-secret(libs/ferriskey-api-client/src/handlers/get_client_secret.rs), but nothing in the CLI calls it, andImportReportdoes not surface it either.Creating a confidential client with
ferris-ctland then having to open the console to read its secret defeats every non-interactive use — CI, provisioning, bootstrapping an environment.Desired solution
printing the raw secret on stdout so it can be piped or captured, with the surrounding output kept on stderr.
ImportReportshould also carry the secret of every confidential client it created, so an import is self-sufficient.Since reading a secret is an audited operation server-side, the command should be explicit about that rather than hiding it behind
client get.Environment
ferris-ctl 0.2.3, FerrisKey server 0.7.0