Universal Module - OIDC flow for Connect-PSUServer

A bit of a big ask, but would be a nice to have, not critical.

Currently for API access a user either has to supply some credentials or an API token that has been pre-made ahead of time. But for OIDC based deployments only a pre-made API key is the only real option, which means you have to login to the admin ui, make the token (preferably short lived) and then put that back into your console securely.

Instead for this, similar to how HashiCorp vault handles this, we're asking if Connect-PSUServer could activate a OIDC flow, whereby a flag like

Connect-PSUServer -ComputerName 'https://some.psu.server.domain.com' -OIDCMakeToken

Could exist, that provides a browser link, the user goes to the browser link, goes through their OIDC flow configured in PSU and then lands at a consent screen in PSU asking for authorization to make a App Token for your current powershell session (limited by some short-lived expiry and tied to the user account that completed the flow).

This in total will reduce the amount of screens an OIDC user has to go through to use the Universal module while utilizing as much of the current systems as I can think off to help with dev time.

To take this a step further, this could also be tied to permissions, so that only certain users would be able to use the OIDC flow to quickly generate a App Token and/or it being a separate permission means that people can generate their own but not be permitted to control others app tokens or system app tokens because they wouldn't have access to the main app tokens area.

Anyway, sorry, lots of words.

The Tl;Dr:

Have new flag on Connect-PSUServer to allow a user to make a API Token from the terminal with minimal browser interaction while still being secure.

Would love to know what you think.