module

Krikri::PluginHelpers::OvirtAuthCommand

OvirtAuthCommand - the pure logic of ovirt.ovirt.ovirt_auth, split out of the plugin so the SSO URL construction (identical string manipulation to ovirtsdk4's _get_access_token / _revoke_access_token, read from the SDK source), the OAuth form body, and the token/revoke response parsing are unit-testable without an oVirt engine. The plugin executes the HTTP calls.

Constants

SSO_REVOKE_PATH = "/ovirt-engine/services/sso-logout"
SSO_TOKEN_PATH = "/ovirt-engine/sso/oauth/token"

Class methods

auth_body(username : String, password : String) : String

_get_access_token's post_data (kerberos grant handled at the plugin level - see the deliberate-limits note there).

Source
extract_token(response_body : String) : Tuple(String | Nil, String | Nil)

_get_sso_response's error walk: OpenID-style error/error_description first, then OAuth-style error_code/error. Returns the access_token on success.

Source
hostname_to_url(hostname : String) : String
Source
revoke_body(token : String) : String
Source
sdk_gate

The collection's check_sdk() gate (module_utils/ovirt.py's HAS_SDK probe): with args that survived AnsibleModule validation, the real module's next act is importing ovirtsdk4 (>= 4.4.0), and a host without it fails with exactly this message before the module body ever runs. krikri probes the host's python3 the same way; a host that HAS the SDK gets the native SSO HTTP flow.

Source
sso_url(api_url : String, revoke : Bool = false) : String

The SDK strips the API URL to scheme://netloc and appends the fixed engine paths - anything before /ovirt-engine/api in the path is dropped. (URI#host/#port is Crystal's netloc.)

Source