EDM-5200: use OIDC password grant in api_module and imagebuilder_module

[EfratIfergan]

EDM-5200: OIDC password grant in api_module.py / imagebuilder_module.py

Problem

The inventory plugin was fixed in PR #62 (EDM-4977) to use the OIDC password
grant instead of HTTP Basic Auth, but the same username/password → Basic Auth
pattern still existed in the shared module utilities:

• plugins/module_utils/api_module.py::set_auth() built an Authorization: Basic <base64> header directly.
• plugins/module_utils/imagebuilder_module.py::_set_auth_headers() did the same.

As a result, every module built on FlightctlAPIModule (flightctl_resource,
flightctl_resource_info, flightctl_certificate_management,
flightctl_enrollment_config_info) and the image builder modules authenticated
with Basic Auth against OIDC-only Flight Control servers and failed.

Fix

Extract the OIDC discovery + password-grant logic into a shared helper and have
the module utilities use it:

• New plugins/module_utils/oidc_auth.py — fetch_auth_config(),
  select_oidc_provider(), oidc_password_grant() (behavior identical to the
  inventory plugin's OIDC flow from EDM-4977).
• api_module.py::set_auth() and imagebuilder_module.py::_set_auth_headers() —
  when username/password are given (and no token), perform the OIDC password
  grant and send a Bearer token. No code path emits Basic Auth.

Note: this PR is scoped to the shared module utilities. The inventory plugin's
_oidc_password_grant() (added in EDM-4977) can be refactored to delegate to
this shared helper in a follow-up; that DRY cleanup is intentionally kept out of
this change to keep it focused on the Basic-Auth fix.

Behavior change

username/password now triggers an OIDC password grant rather than Basic Auth.
This is intentional and matches the inventory plugin (EDM-4977) — it fixes auth
against OIDC-only servers.

Known considerations

• Image builder host: The image builder modules are invoked with
  flightctl_host pointing at the image-builder service, so OIDC discovery targets
  <image-builder-host>/api/v1/auth/config. This assumes that host serves (or is
  fronted by the same gateway that serves) the Flight Control auth config endpoint
  — the common single-gateway deployment model. Please confirm this holds for your
  image-builder deployment topology.

Tests

• New tests/unit/plugins/module_utils/test_oidc_auth.py covers the shared helper
  (provider selection, discovery, password-grant payload, error paths, ca_path
  propagation).
• test_api_module.py / test_imagebuilder_module.py updated: Bearer token on the
  wire, base-host stripping, and regression guards that no Basic Auth is ever sent.
• Full unit suite: 236 passed.

Rollback

Revert this commit. The change is isolated to plugins/module_utils/oidc_auth.py
(new), api_module.py, imagebuilder_module.py, and their unit tests.

---

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2f6c3443-bd5e-45a1-98b0-919720ff8805

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}