- type: replace
  path: /instance_groups/name=uaa/jobs/name=uaa/properties/uaa/clients/paas-admin?
  value:
    override: true
    authorized-grant-types: authorization_code,client_credentials,refresh_token
    autoapprove: true
    secret: "((uaa_clients_paas_admin_secret))"
    scope: cloud_controller.read,cloud_controller.admin_read_only,cloud_controller.global_auditor,cloud_controller.write,scim.me,openid,profile,uaa.user,cloud_controller.admincloud_controller.read,cloud_controller.admin_read_only,cloud_controller.global_auditor,cloud_controller.write,scim.me,openid,profile,uaa.user,cloud_controller.admin
    authorities: scim.userids,scim.invite,scim.read,scim.write
    redirect-uri: "https://admin.((system_domain))/auth/login/callback"

- type: replace
  path: /variables/-
  value:
    name: uaa_clients_paas_admin_secret
    type: password

- type: replace
  path: /instance_groups/name=uaa/jobs/name=uaa/properties/uaa/clients/paas-admin?
  value:
    override: true
    authorized-grant-types: authorization_code,client_credentials,refresh_token
    autoapprove: true
    secret: "((uaa_clients_paas_admin_secret))"
    scope: cloud_controller.read,cloud_controller.admin_read_only,cloud_controller.global_auditor,cloud_controller.write,scim.me,openid,profile,uaa.user,cloud_controller.admincloud_controller.read,cloud_controller.admin_read_only,cloud_controller.global_auditor,cloud_controller.write,scim.me,openid,profile,uaa.user,cloud_controller.admin
    authorities: scim.userids,scim.invite,scim.read,scim.write,oauth.login
    redirect-uri: "https://admin.((system_domain))/auth/login/callback"

- type: replace
  path: /variables/-
  value:
    name: uaa_clients_paas_admin_secret
    type: password

Add OAuth login scope for Pazmin
Add OAuth login scope for Pazmin

We'd like to moce the forgotten password functionality from UAA to
Pazmin, to gain more control of what's happening and how it's being
presented to our beloved users.

The Password Reset API call requires either: `uaa.admin`, `oauth.login`
or `zones.uaa.admin` scope to perform it's action.
