Adds org login client-credentials command

README.md

@@ -72,6 +72,7 @@ sfdx plugins
 
 - [`sf org list auth`](#sf-org-list-auth)
 - [`sf org login access-token`](#sf-org-login-access-token)
+- [`sf org login client-credentials`](#sf-org-login-client-credentials)
 - [`sf org login jwt`](#sf-org-login-jwt)
 - [`sf org login sfdx-url`](#sf-org-login-sfdx-url)
 - [`sf org login web`](#sf-org-login-web)
@@ -166,6 +167,75 @@ FLAG DESCRIPTIONS
 
 _See code: [src/commands/org/login/access-token.ts](https://github.com/salesforcecli/plugin-auth/blob/5.0.4/src/commands/org/login/access-token.ts)_
 
+## `sf org login client-credentials`
+
+Log in to a Salesforce org using the OAuth 2.0 client credentials flow.
+
+```
+USAGE
+  $ SF_CLIENT_SECRET=mySecretKey sf org login client-credentials -o <value> -i <value> [--json] [--flags-dir <value>] [-r <value>] [-d] [-s] [-a <value>]
+
+FLAGS
+  -a, --alias=<value>          Alias for the org.
+  -d, --set-default-dev-hub    Set the authenticated org as the default Dev Hub.
+  -i, --client-id=<value>      (required) OAuth client ID (also called consumer key) of your custom connected app.
+  -o, --username=<value>       (required) Username of the user logging in.
+  -r, --instance-url=<value>   URL of the instance that the org lives on.
+  -s, --set-default            Set the authenticated org as the default that all org-related commands run against.
+
+GLOBAL FLAGS
+  --flags-dir=<value>  Import flag values from a directory.
+  --json               Format output as json.
+
+DESCRIPTION
+  Log in to a Salesforce org using the OAuth 2.0 client credentials flow.
+
+  Use this command in automated environments where you can’t interactively log in with a browser, such as in CI/CD
+  scripts.
+
+  Logging into an org authorizes the CLI to run other commands that connect to that org, such as deploying or retrieving
+  a project. You can log into many types of orgs, such as sandboxes, Dev Hubs, Env Hubs, production orgs, and scratch
+  orgs.
+
+  Complete these steps before you run this command:
+
+  1. Create a connected app or external client app in your org. Enable the client credentials flow and choose the user
+  that the integration runs as.
+  2. Make note of the consumer key (also called client id) and consumer secret (also called client secret) that are
+  generated for you. Set the consumer secret in the SF_CLIENT_SECRET environment variable. When you run this command,
+  set the --client-id flag to the consumer key.
+  3. Use your org’s My Domain URL with --instance-url. The client credentials flow doesn’t support login.salesforce.com
+  or test.salesforce.com.
+
+  See https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_client_credentials_flow.htm for more
+  information.
+
+  We recommend that you set an alias when you log into an org. Aliases make it easy to later reference this org when
+  running commands that require it. If you don’t set an alias, the username for the user associated with the client credentials flow is used.
+  If you run multiple commands that reference the same org, consider setting the org as your default. Use
+  --set-default for your default scratch org or sandbox, or --set-default-dev-hub for your default Dev Hub.
+
+EXAMPLES
+  Set the org as the default and give it an alias:
+
+    $ SF_CLIENT_SECRET=very-secret sf org login client-credentials --client-id \
+      04580y4051234051 --instance-url https://MyDomainName.my.salesforce.com --alias ci-org --set-default
+
+  Set the org as the default Dev Hub and give it an alias:
+
+    $ SF_CLIENT_SECRET=very-secret sf org login client-credentials --client-id \
+      04580y4051234051 --instance-url https://MyDomainName.my.salesforce.com --alias ci-dev-hub --set-default-dev-hub
+
+FLAG DESCRIPTIONS
+  -r, --instance-url=<value>  URL of the instance that the org lives on.
+
+    To specify a production environment My Domain URL, use the format "https://<MyDomainName>.my.salesforce.com".
+
+    To specify a sandbox, set --instance-url to "https://<MyDomainName>--<SandboxName>.sandbox.my.salesforce.com".
+```
+
+_See code: [src/commands/org/login/client-credentials.ts](https://github.com/salesforcecli/plugin-auth/blob/5.0.4/src/commands/org/login/client-credentials.ts)_
+
 ## `sf org login jwt`
 
 Log in to a Salesforce org using a JSON web token (JWT).

command-snapshot.json

@@ -31,6 +31,24 @@
     ],
     "plugin": "@salesforce/plugin-auth"
   },
+  {
+    "alias": [],
+    "command": "org:login:client-credentials",
+    "flagAliases": [],
+    "flagChars": ["a", "d", "i", "p", "r", "s"],
+    "flags": [
+      "alias",
+      "client-id",
+      "flags-dir",
+      "instance-url",
+      "json",
+      "loglevel",
+      "no-prompt",
+      "set-default",
+      "set-default-dev-hub"
+    ],
+    "plugin": "@salesforce/plugin-auth"
+  },
   {
     "alias": ["force:auth:jwt:grant", "auth:jwt:grant"],
     "command": "org:login:jwt",

messages/client.credentials.md

@@ -0,0 +1,45 @@
+# summary
+
+Log in to a Salesforce org using the OAuth 2.0 client credentials flow.
+
+# description
+
+Use this command in automated environments where you can’t interactively log in with a browser, such as in CI/CD scripts.
+
+Logging into an org authorizes the CLI to run other commands that connect to that org, such as deploying or retrieving a project. You can log into many types of orgs, such as sandboxes, Dev Hubs, Env Hubs, production orgs, and scratch orgs.
+
+Complete these steps before you run this command:
+
+    1. Create a connected app or external client app in your org. Enable the client credentials flow and choose the user that the integration runs as.
+    2. Make note of the consumer key (also called client id) and consumer secret (also called client secret) that are generated for you. Set the consumer secret in the SF_CLIENT_SECRET environment variable. When you run this command, set the --client-id flag to the consumer key so the secret isn't passed as a command argument.
+    3. Use your org’s My Domain URL with --instance-url. The client credentials flow doesn’t support login.salesforce.com or test.salesforce.com.
+
+See https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_client_credentials_flow.htm for more information.
+
+We recommend that you set an alias when you log into an org. Aliases make it easy to later reference this org when running commands that require it. If you don’t set an alias, you use the username that you specified when you logged in to the org. If you run multiple commands that reference the same org, consider setting the org as your default. Use --set-default for your default scratch org or sandbox, or --set-default-dev-hub for your default Dev Hub.
+
+# examples
+
+- Set the org as the default and give it an alias:
+
+  SF_CLIENT_SECRET=very-secret <%= config.bin %> <%= command.id %> --client-id 04580y4051234051 --instance-url https://MyDomainName.my.salesforce.com --alias ci-org --set-default
+
+- Set the org as the default Dev Hub and give it an alias:
+
+  SF_CLIENT_SECRET=very-secret <%= config.bin %> <%= command.id %> --client-id 04580y4051234051 --instance-url https://MyDomainName.my.salesforce.com --alias ci-dev-hub --set-default-dev-hub
+
+# ClientCredentialsGrantError
+
+We encountered a client credentials error, which is likely not an issue with Salesforce CLI. Here’s the error: %s
+
+# httpsRequired
+
+The client credentials flow requires an HTTPS instance URL. Use your org’s My Domain URL, such as https://MyDomainName.my.salesforce.com.
+
+# clientSecretMissingResponse
+
+The client secret environment variable was not set, aborting login call.
+
+# invalidTokenResponse
+
+The authorization server returned an incomplete token response.

package.json

@@ -66,6 +66,9 @@
             "description": "Authorize an org for use with Salesforce CLI.",
             "longDescription": "Use the auth commands to authorize a Salesforce org for use with the Salesforce CLI.",
             "subtopics": {
+              "client-credentials": {
+                "description": "authorize an org using OAuth client credentials"
+              },
               "jwt": {
                 "description": "authorize an org using JWT"
               },

schemas/org-login-client__credentials.json

@@ -0,0 +1,135 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$ref": "#/definitions/AuthFields",
+  "definitions": {
+    "AuthFields": {
+      "type": "object",
+      "properties": {
+        "clientApps": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "properties": {
+              "clientId": {
+                "type": "string"
+              },
+              "clientSecret": {
+                "type": "string"
+              },
+              "accessToken": {
+                "type": "string"
+              },
+              "refreshToken": {
+                "type": "string"
+              },
+              "oauthFlow": {
+                "type": "string",
+                "const": "web"
+              }
+            },
+            "required": ["clientId", "accessToken", "refreshToken", "oauthFlow"],
+            "additionalProperties": false
+          }
+        },
+        "accessToken": {
+          "type": "string"
+        },
+        "alias": {
+          "type": "string"
+        },
+        "authCode": {
+          "type": "string"
+        },
+        "clientId": {
+          "type": "string"
+        },
+        "clientSecret": {
+          "type": "string"
+        },
+        "created": {
+          "type": "string"
+        },
+        "createdOrgInstance": {
+          "type": "string"
+        },
+        "devHubUsername": {
+          "type": "string"
+        },
+        "instanceUrl": {
+          "type": "string"
+        },
+        "instanceApiVersion": {
+          "type": "string"
+        },
+        "instanceApiVersionLastRetrieved": {
+          "type": "string"
+        },
+        "isDevHub": {
+          "type": "boolean"
+        },
+        "loginUrl": {
+          "type": "string"
+        },
+        "orgId": {
+          "type": "string"
+        },
+        "password": {
+          "type": "string"
+        },
+        "privateKey": {
+          "type": "string"
+        },
+        "refreshToken": {
+          "type": "string"
+        },
+        "snapshot": {
+          "type": "string"
+        },
+        "userId": {
+          "type": "string"
+        },
+        "username": {
+          "type": "string"
+        },
+        "usernames": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "userProfileName": {
+          "type": "string"
+        },
+        "expirationDate": {
+          "type": "string"
+        },
+        "tracksSource": {
+          "type": "boolean"
+        },
+        "name": {
+          "type": "string"
+        },
+        "instanceName": {
+          "type": "string"
+        },
+        "namespacePrefix": {
+          "type": ["string", "null"]
+        },
+        "isSandbox": {
+          "type": "boolean"
+        },
+        "isScratch": {
+          "type": "boolean"
+        },
+        "trailExpirationDate": {
+          "type": ["string", "null"]
+        },
+        "orgEdition": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Fields for authorization, org, and local information."
+    }
+  }
+}