Add support for Dynatrace Platform Tokens for Authentication

[Reinhard-Pilz-Dynatrace]

Platform Tokens are likely a suitable alternative for fetching Bearer Tokens via OAuth Clients.

Potential solution for Terraform:

• Introduce an environment variable DT_BEARER_TOKEN for authentication
• If present, it should supersede the credentials DT_CLIENT_ID and DT_CLIENT_SECRET. The Bearer Token would already be known

[anton-freyberg]

@Reinhard-Pilz-Dynatrace I added the following: #590.

Idea: we can scope oauth tokens to a service user permissions, while Platform tokens are bound to a user. For config as code, we'd also like the service user as pipelines can break if some user leaves a company.

[ftmazzone]

@Reinhard-Pilz-Dynatrace I added the following: #590.

Idea: we can scope oauth tokens to a service user permissions, while Platform tokens are bound to a user. For config as code, we'd also like the service user as pipelines can break if some user leaves a company.

This would be a nice solution to have platform tokens for service user to avoid this risk.
The issue with oauth tokens is that the required permissions are very high. The service user would need to have the account-user-management permission to get an OAuth client.

[Reinhard-Pilz-Dynatrace]

Hi @anton-freyberg and @ftmazzone
Thanks a lot for your feedback - much appreciated. We will be looking into this issue and #590 in the beginning of next year.

[anton-freyberg]

@ftmazzone you need account management permission to create a service user, but the service user himself does not need these permissions.

[ftmazzone]

@ftmazzone you need account management permission to create a service user, but the service user himself does not need these permissions.

yes, this would be a good solution.

I've tried this morning to create an OAuth client for a service user but got the following error in Dynatrace console:
The user associated with this email address doesn't fulfill all requirements. - See details above.

The details are :

The user associated with the service user email must fulfill

    User has to be active
    User must hold the account-user-management permission