export SSO_IP=`kubectl get svc -A | grep "sso " | awk '{print $4}'`
export ASMUI_PASS=`kubectl get secret pfxm-asmui-creds -o json -n powerflex | jq '.data | map_values(@base64d)' | jq -r '.["keycloak-password"]'`
export PM_TOKEN=`curl -k --location --request POST "https://${SSO_IP}:8080/rest/auth/login" --header 'Accept: application/json' --header 'Content-Type: application/json' --data "{\"username\": \"asmuiuser\",\"password\": \"$ASMUI_PASS\"}" | jq -r .access_token`
export IN_IP=`kubectl get svc -A | grep -m1 rke2-ingress-nginx-controller | sort | awk '{print $5}'`

LOCAL_CLIENT_ID=767ec8f0-dc87-431c-ae63-9d9e0fad58d4
EXT_CLIENT_ID=b151947c-b514-4997-a369-a9b76f26b050
METADATA=https://login.microsoftonline.com/945c199a-83a2-4e80-9f8c-5a91be5752dd/v2.0/.well-known/openid-configuration
IDP=511ff058-d9d9-4fe0-a4f0-2451c513184a
ROLE=SuperUser

curl -kLvv --request POST \
  --url https://$IN_IP/rest/v1/oauth2-token-exchanges \
  --header 'Content-Type: application/json' \
  --header 'clientId: ' \
  --header "Authorization: Bearer ${PM_TOKEN}" \
  --data "{
  \"ciam_oauth2_client_id\": \"$LOCAL_CLIENT_ID\",
  \"customer_client_id\": \"$EXT_CLIENT_ID\",
  \"customer_metadata_url\": \"$METADATA\",
  \"idp_service_id\": \"$IDP\",
  \"static_roles\": [
    \"$ROLE\"
  ]}"
