The local set up for testing 𝕰𝖗s𝖆𝖙𝖟 clients.

To make an 𝕰𝖗s𝖆𝖙𝖟 client
1. Select an admin client. All provisioners and 𝕰𝖗s𝖆𝖙𝖟 clients are under an admin
2. Create a new provisioning client, P
3. Create the 𝕰𝖗s𝖆𝖙𝖟 client, E
4. Set the attribute ersatz_client to true in the CLI
5. Create the permission with client_ID == E and ersatz_id =[E] (list with a single entry)

E.g. of a permssion is

        admin_id : admin:test/vo_1
     can_approve : true
      can_create : true
        can_read : true
      can_remove : true
  can_substitute : true
       can_write : true
       client_id : localhost:command.line2
       ersatz_id : ["client:/my_ersatz"]
   permission_id : oa4mp:/permission/60090db325f8773875141b2084e7dad2/1652704979860

=================

This requires a client be in a VO and administered by it. On my local machine
admin id: admin:test/vo_1
provisioner id: localhost:command.line2
𝕰𝖗s𝖆𝖙𝖟 id: client:/my_ersatz

How to test.
You will need two running instances of oa2-client. One to provision and the other to
do the substitution.
** Make sure you do a valid flow for localhost:command.line2.
** Check the testing-readme.txt for the correct parameters!

1. Start flow for localhost:command.line2
   a. get the access token(s)
   b. save it to $ERSATZ

2. Start 𝕰𝖗s𝖆𝖙𝖟 client issue
   a. load  client:/my_ersatz
   b. read $ERSATZ -p
      (NOTE THE -p flag, which tells the system to provision from the stored state, rather than
       replace current state with it.)
   c. do token exchanges with -at (default) and -xt

You should be able to go to the oa2-cli and search for the transactions and tokens
that are associated with these clients.

===========
Testing on dev

- Generic client, all tokens are simple
  Provisioner: dev:test/vo1
Ersatz client: dev:test/my_ersatz
No special scopes.
Any IDP

- client with WLCG, all tokens are simple
  Provisioner: dev:test/vo1
Ersatz client: dev:test/my_ersatz2
No special scopes.
IDP: NCSA (Needs to have an eppn)