A user with permissions to create a token cannot create it in the web gui

[programmerq]

Expected behavior:

A user with the create permission for tokens should be able to create a token in the web interface.

Current behavior:

The web interface complains that the user does not have the update permission when a user tries to create a token. It appears the web gui will create and then update. The same user is able to successfully do a tctl create command from the command line since that only issues an api call with the create verb.

Bug details:

• Teleport version
• Recreation steps
• Debug logs

gz#5325

[russjones]

@kimlisa @hatched Please sync with @r0mant about this when you are working on the discover wizard.

I don't think we need to go back and fix this since we are changing this flow completely anyway.

[marcoandredinis]

There's a difference between tctl and web clients:

• tctl uses GenerateToken - requires create verb on token resource
• web uses UpsertToken - requires create and update verb on token resource

That's why we get this error

We can't use GenerateToken from web because it doesn't allow setting the JoinMethod required to generate a Provision Token for IAM joining.

I guess our usage of the Upsert<resource> methods leads to this situations, I'm sure there are other resources with this approach (roles comes to mind)

I'll open a PR to fix this