feat: remove collection support for oauth (#15623)

Co-authored-by: Alan Rominger <arominge@redhat.com>

18 files changed, 62 insertions, 824 deletions

diff --git a/awx_collection/README.md b/awx_collection/README.md
index 73efb5e249..767073c4ef 100644
--- a/awx_collection/README.md
+++ b/awx_collection/README.md
@@ -32,11 +32,28 @@ Installing the `tar.gz` involves no special instructions.
 ## Running
 
 Non-deprecated modules in this collection have no Python requirements, but
-may require the AWX CLI
+may require the official [AWX CLI](https://pypi.org/project/awxkit/)
 in the future. The `DOCUMENTATION` for each module will report this.
 
 You can specify authentication by host, username, and password.
 
+These can be specified via (from highest to lowest precedence):
+
+ - direct module parameters
+ - environment variables (most useful when running against localhost)
+ - a config file path specified by the `tower_config_file` parameter
+ - a config file at `~/.tower_cli.cfg`
+ - a config file at `/etc/tower/tower_cli.cfg`
+
+Config file syntax looks like this:
+
+```
+[general]
+host = https://localhost:8043
+verify_ssl = true
+username = foo
+password = bar
+```
 
 ## Release and Upgrade Notes
 
@@ -46,6 +63,7 @@ Notable releases of the `awx.awx` collection:
  - 11.0.0 has no non-deprecated modules that depend on the deprecated `tower-cli` [PyPI](https://pypi.org/project/ansible-tower-cli/).
  - 19.2.1 large renaming purged "tower" names (like options and module names), adding redirects for old names
  - 21.11.0 "tower" modules deprecated and symlinks removed.
+ - 25.0.0 "token" and "application" modules have been removed as oauth is no longer supported, use basic auth instead
  - X.X.X added support of named URLs to all modules. Anywhere that previously accepted name or id can also support named URLs
  - 0.0.1-devel is the version you should see if installing from source, which is intended for development and expected to be unstable.
 
diff --git a/awx_collection/TESTING.md b/awx_collection/TESTING.md
index 71748769c3..a77e4780d4 100644
--- a/awx_collection/TESTING.md
+++ b/awx_collection/TESTING.md
@@ -109,7 +109,7 @@ rootdir: /home/student1/awx, configfile: pytest.ini
 plugins: cov-2.10.1, django-3.10.0, pythonpath-0.7.3, mock-1.11.1, timeout-1.4.2, forked-1.3.0, xdist-1.34.0
 collected 116 items
 
-awx_collection/test/awx/test_application.py::test_create_application PASSED                [  0%]
+awx_collection/test/awx/test_ad_hoc_wait.py::test_ad_hoc_wait_successful PASSED            [  0%]
 awx_collection/test/awx/test_completeness.py::test_completeness PASSED                     [  1%]
 
 ...
@@ -124,18 +124,18 @@ FAILED awx_collection/test/awx/test_module_utils.py::test_type_warning - SystemE
 make: *** [Makefile:382: test_collection] Error 1
 ```
 
-In addition to running all of the tests, you can also specify specific tests to run. This is useful when developing a single module. In this example, we will run the tests for the `token` module:
+In addition to running all of the tests, you can also specify specific tests to run. This is useful when developing a single module. In this example, we will run the tests for the `project` module:
 
 ```
-$ pytest awx_collection/test/awx/test_token.py
+$ pytest awx_collection/test/awx/test_project.py
 ============================ test session starts ============================
 platform darwin -- Python 3.7.0, pytest-3.6.0, py-1.8.1, pluggy-0.6.0
 django: settings: awx.settings.development (from ini)
 rootdir: /Users/jowestco/junk/awx, inifile: pytest.ini
 plugins: xdist-1.27.0, timeout-1.3.4, pythonpath-0.7.3, mock-1.11.1, forked-1.1.3, django-3.9.0, cov-2.8.1
-collected 1 item                                                                                                                                                  
+collected 1 item
 
-awx_collection/test/awx/test_token.py .                               [100%]
+awx_collection/test/awx/test_project.py .                               [100%]
 
 ========================= 1 passed in 1.72 seconds =========================
 ```
diff --git a/awx_collection/meta/runtime.yml b/awx_collection/meta/runtime.yml
index 7ffdbce161..23c0f42cbb 100644
--- a/awx_collection/meta/runtime.yml
+++ b/awx_collection/meta/runtime.yml
@@ -5,7 +5,6 @@ action_groups:
     - ad_hoc_command
     - ad_hoc_command_cancel
     - ad_hoc_command_wait
-    - application
     - bulk_job_launch
     - bulk_host_create
     - bulk_host_delete
@@ -42,7 +41,6 @@ action_groups:
     - settings
     - subscriptions
     - team
-    - token
     - user
     - workflow_approval
     - workflow_job_template_node
diff --git a/awx_collection/plugins/doc_fragments/auth.py b/awx_collection/plugins/doc_fragments/auth.py
index 763fe94dcd..f8241e1c78 100644
--- a/awx_collection/plugins/doc_fragments/auth.py
+++ b/awx_collection/plugins/doc_fragments/auth.py
@@ -32,16 +32,6 @@ options:
     - If value not set, will try environment variable C(CONTROLLER_PASSWORD) and then config files
     type: str
     aliases: [ tower_password ]
-  controller_oauthtoken:
-    description:
-    - The OAuth token to use.
-    - This value can be in one of two formats.
-    - A string which is the token itself. (i.e. bqV5txm97wqJqtkxlMkhQz0pKhRMMX)
-    - A dictionary structure as returned by the token module.
-    - If value not set, will try environment variable C(CONTROLLER_OAUTH_TOKEN) and then config files
-    type: raw
-    version_added: "3.7.0"
-    aliases: [ tower_oauthtoken ]
   validate_certs:
     description:
     - Whether to allow insecure connections to AWX.
diff --git a/awx_collection/plugins/doc_fragments/auth_plugin.py b/awx_collection/plugins/doc_fragments/auth_plugin.py
index b46eaf6bbf..49118baf71 100644
--- a/awx_collection/plugins/doc_fragments/auth_plugin.py
+++ b/awx_collection/plugins/doc_fragments/auth_plugin.py
@@ -43,17 +43,6 @@ options:
         version: '4.0.0'
         why: Collection name change
         alternatives: 'CONTROLLER_PASSWORD'
-  oauth_token:
-    description:
-    - The OAuth token to use.
-    env:
-    - name: CONTROLLER_OAUTH_TOKEN
-    - name: TOWER_OAUTH_TOKEN
-      deprecated:
-        collection_name: 'awx.awx'
-        version: '4.0.0'
-        why: Collection name change
-        alternatives: 'CONTROLLER_OAUTH_TOKEN'
   verify_ssl:
     description:
     - Specify whether Ansible should verify the SSL certificate of the controller host.
diff --git a/awx_collection/plugins/lookup/controller_api.py b/awx_collection/plugins/lookup/controller_api.py
index 4d5d79cf91..d1b213f12b 100644
--- a/awx_collection/plugins/lookup/controller_api.py
+++ b/awx_collection/plugins/lookup/controller_api.py
@@ -18,7 +18,7 @@ description:
 options:
   _terms:
     description:
-      - The endpoint to query, i.e. teams, users, tokens, job_templates, etc.
+      - The endpoint to query, i.e. teams, users, job_templates, etc.
     required: True
   query_params:
     description:
diff --git a/awx_collection/plugins/module_utils/awxkit.py b/awx_collection/plugins/module_utils/awxkit.py
index 02549b73e3..ad9c3a9cc4 100644
--- a/awx_collection/plugins/module_utils/awxkit.py
+++ b/awx_collection/plugins/module_utils/awxkit.py
@@ -33,13 +33,8 @@ class ControllerAWXKitModule(ControllerModule):
 
     def authenticate(self):
         try:
-            if self.oauth_token:
-                # MERGE: fix conflicts with removal of OAuth2 token from collection branch
-                self.connection.login(None, None)
-                self.authenticated = True
-            elif self.username:
-                self.connection.login(username=self.username, password=self.password)
-                self.authenticated = True
+            self.connection.login(username=self.username, password=self.password)
+            self.authenticated = True
         except Exception:
             self.fail_json("Failed to authenticate")
 
diff --git a/awx_collection/plugins/module_utils/controller_api.py b/awx_collection/plugins/module_utils/controller_api.py
index c2681a49af..2e9cdd126c 100644
--- a/awx_collection/plugins/module_utils/controller_api.py
+++ b/awx_collection/plugins/module_utils/controller_api.py
@@ -6,7 +6,7 @@ from ansible.module_utils.basic import AnsibleModule, env_fallback
 from ansible.module_utils.urls import Request, SSLValidationError, ConnectionError
 from ansible.module_utils.parsing.convert_bool import boolean as strtobool
 from ansible.module_utils.six import PY2
-from ansible.module_utils.six import raise_from, string_types
+from ansible.module_utils.six import raise_from
 from ansible.module_utils.six.moves import StringIO
 from ansible.module_utils.six.moves.urllib.error import HTTPError
 from ansible.module_utils.six.moves.http_cookiejar import CookieJar
@@ -55,9 +55,6 @@ class ControllerModule(AnsibleModule):
         controller_password=dict(no_log=True, aliases=['tower_password'], required=False, fallback=(env_fallback, ['CONTROLLER_PASSWORD', 'TOWER_PASSWORD'])),
         validate_certs=dict(type='bool', aliases=['tower_verify_ssl'], required=False, fallback=(env_fallback, ['CONTROLLER_VERIFY_SSL', 'TOWER_VERIFY_SSL'])),
         request_timeout=dict(type='float', required=False, fallback=(env_fallback, ['CONTROLLER_REQUEST_TIMEOUT'])),
-        controller_oauthtoken=dict(
-            type='raw', no_log=True, aliases=['tower_oauthtoken'], required=False, fallback=(env_fallback, ['CONTROLLER_OAUTH_TOKEN', 'TOWER_OAUTH_TOKEN'])
-        ),
         controller_config_file=dict(type='path', aliases=['tower_config_file'], required=False, default=None),
     )
     # Associations of these types are ordered and have special consideration in the modified associations function
@@ -68,15 +65,12 @@ class ControllerModule(AnsibleModule):
         'password': 'controller_password',
         'verify_ssl': 'validate_certs',
         'request_timeout': 'request_timeout',
-        'oauth_token': 'controller_oauthtoken',
     }
     host = '127.0.0.1'
     username = None
     password = None
     verify_ssl = True
     request_timeout = 10
-    oauth_token = None
-    oauth_token_id = None
     authenticated = False
     config_name = 'tower_cli.cfg'
     version_checked = False
@@ -111,20 +105,6 @@ class ControllerModule(AnsibleModule):
             if direct_value is not None:
                 setattr(self, short_param, direct_value)
 
-        # Perform magic depending on whether controller_oauthtoken is a string or a dict
-        if self.params.get('controller_oauthtoken'):
-            token_param = self.params.get('controller_oauthtoken')
-            if isinstance(token_param, dict):
-                if 'token' in token_param:
-                    self.oauth_token = self.params.get('controller_oauthtoken')['token']
-                else:
-                    self.fail_json(msg="The provided dict in controller_oauthtoken did not properly contain the token entry")
-            elif isinstance(token_param, string_types):
-                self.oauth_token = self.params.get('controller_oauthtoken')
-            else:
-                error_msg = "The provided controller_oauthtoken type was not valid ({0}). Valid options are str or dict.".format(type(token_param).__name__)
-                self.fail_json(msg=error_msg)
-
         # Perform some basic validation
         if not re.match('^https{0,1}://', self.host):
             self.host = "https://{0}".format(self.host)
@@ -312,9 +292,6 @@ class ControllerAPIModule(ControllerModule):
     IDENTITY_FIELDS = {'users': 'username', 'workflow_job_template_nodes': 'identifier', 'instances': 'hostname'}
     ENCRYPTED_STRING = "$encrypted$"
 
-    # which app was used to create the oauth_token
-    oauth_token_app_key = None
-
     def __init__(self, argument_spec, direct_params=None, error_callback=None, warn_callback=None, **kwargs):
         kwargs['supports_check_mode'] = True
 
@@ -338,8 +315,7 @@ class ControllerAPIModule(ControllerModule):
             for field_name in ControllerAPIModule.IDENTITY_FIELDS.values():
                 if field_name in item:
                     return item[field_name]
-
-            if item.get('type', None) in ('o_auth2_access_token', 'credential_input_source'):
+            if item.get('type', None) == 'credential_input_source':
                 return item['id']
 
         if allow_unknown:
@@ -498,15 +474,12 @@ class ControllerAPIModule(ControllerModule):
         # Extract the headers, this will be used in a couple of places
         headers = kwargs.get('headers', {})
 
-        # Authenticate to AWX (if we don't have a token and if not already done so)
-        if not self.oauth_token and not self.authenticated:
-            # This method will set a cookie in the cookie jar for us and also an oauth_token when possible
+        # Authenticate to AWX (if not already done so)
+        if not self.authenticated:
+            # This method will set a cookie in the cookie jar for us
             self.authenticate(**kwargs)
-        if self.oauth_token:
-            # If we have a oauth token, we just use a bearer header
-            headers['Authorization'] = 'Bearer {0}'.format(self.oauth_token)
-        elif self.username and self.password:
-            headers['Authorization'] = self._get_basic_authorization_header()
+
+        headers['Authorization'] = self._get_basic_authorization_header()
 
         if method in ['POST', 'PUT', 'PATCH']:
             headers.setdefault('Content-Type', 'application/json')
@@ -665,71 +638,11 @@ class ControllerAPIModule(ControllerModule):
                 },
             )
 
-    def _authenticate_create_token(self, app_key=None):
-        # in case of failure and to give a chance to authenticate via other means, should not raise exceptions
-        # but only warnings
-        if self.username and self.password:
-            login_data = {
-                "description": "Automation Platform Controller Module Token",
-                "application": None,
-                "scope": "write",
-            }
-
-            api_token_url = self.build_url("tokens", app_key=app_key).geturl()
-            try:
-                response = self.session.open(
-                    'POST',
-                    api_token_url,
-                    validate_certs=self.verify_ssl,
-                    timeout=self.request_timeout,
-                    follow_redirects=True,
-                    data=dumps(login_data),
-                    headers={
-                        "Content-Type": "application/json",
-                        "Authorization": self._get_basic_authorization_header(),
-                    },
-                )
-
-            except Exception as exp:
-                self.warn("url: {0} - Failed to get token: {1}".format(api_token_url, exp))
-                return
-
-            token_response = None
-            try:
-                token_response = response.read()
-                response_json = loads(token_response)
-                self.oauth_token_id = response_json['id']
-                self.oauth_token = response_json['token']
-                # set the app that received the token create request, this is needed when removing the token at logout
-                self.oauth_token_app_key = app_key
-            except Exception as exp:
-                self.warn(
-                    "url: {0} - Failed to extract token information from login response: {1}, response: {2}".format(
-                        api_token_url, exp, token_response,
-                    )
-                )
-                return
-
-        return None
-
     def authenticate(self, **kwargs):
-        # As a temporary solution for version 4.6 try to get a token by using basic authentication from:
-        #  /api/gateway/v1/tokens/ when app_key is gateway
-        #  /api/v2/tokens/ when app_key is None and _COLLECTION_TYPE = "awx"
-        #  /api/controller/v2/tokens/ when app_key is None and _COLLECTION_TYPE != "awx"
-        for app_key in ["gateway", None]:
-            # to give a chance to authenticate via basic authentication in case of failure,
-            # _authenticate_create_token,  should not raise exception but only warnings,
-            self._authenticate_create_token(app_key=app_key)
-            if self.oauth_token:
-                break
-
-        if not self.oauth_token:
-            # if not having an oauth_token and when collection_type is awx try to login with basic authentication
-            try:
-                self._authenticate_with_basic_auth()
-            except Exception as exp:
-                self.fail_json(msg='Failed to get user info: {0}'.format(exp))
+        try:
+            self._authenticate_with_basic_auth()
+        except Exception as exp:
+            self.fail_json(msg='Failed to get user info: {0}'.format(exp))
 
         self.authenticated = True
 
@@ -1080,37 +993,7 @@ class ControllerAPIModule(ControllerModule):
             )
 
     def logout(self):
-        if self.authenticated and self.oauth_token_id:
-            # Attempt to delete our current token from /api/v2/tokens/
-            # Post to the tokens endpoint with baisc auth to try and get a token
-            api_token_url = self.build_url(
-                "tokens/{0}/".format(self.oauth_token_id),
-                app_key=self.oauth_token_app_key,
-            ).geturl()
-
-            try:
-                self.session.open(
-                    'DELETE',
-                    api_token_url,
-                    validate_certs=self.verify_ssl,
-                    timeout=self.request_timeout,
-                    follow_redirects=True,
-                    headers={
-                        "Authorization": self._get_basic_authorization_header(),
-                    }
-                )
-                self.oauth_token_id = None
-                self.oauth_token = None
-                self.authenticated = False
-            except HTTPError as he:
-                try:
-                    resp = he.read()
-                except Exception as e:
-                    resp = 'unknown {0}'.format(e)
-                self.warn('Failed to release token: {0}, response: {1}'.format(he, resp))
-            except (Exception) as e:
-                # Sanity check: Did the server send back some kind of internal error?
-                self.warn('Failed to release token {0}: {1}'.format(self.oauth_token_id, e))
+        self.authenticated = False
 
     def is_job_done(self, job_status):
         if job_status in ['new', 'pending', 'waiting', 'running']:
diff --git a/awx_collection/plugins/modules/application.py b/awx_collection/plugins/modules/application.py
deleted file mode 100644
index 4c858394d8..0000000000
--- a/awx_collection/plugins/modules/application.py
+++ /dev/null
@@ -1,162 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-
-# (c) 2020,Geoffrey Bachelot <bachelotg@gmail.com>
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-
-ANSIBLE_METADATA = {'metadata_version': '1.1', 'status': ['preview'], 'supported_by': 'community'}
-
-
-DOCUMENTATION = '''
----
-module: application
-author: "Geoffrey Bacheot (@jffz)"
-short_description: create, update, or destroy Automation Platform Controller applications
-description:
-    - Create, update, or destroy Automation Platform Controller applications. See
-      U(https://www.ansible.com/tower) for an overview.
-options:
-    name:
-      description:
-        - Name of the application.
-      required: True
-      type: str
-    new_name:
-      description:
-        - Setting this option will change the existing name (looked up via the name field.
-      type: str
-    description:
-      description:
-        - Description of the application.
-      type: str
-    authorization_grant_type:
-      description:
-        - The grant type the user must use for acquire tokens for this application.
-      choices: ["password", "authorization-code"]
-      type: str
-      required: False
-    client_type:
-      description:
-        - Set to public or confidential depending on how secure the client device is.
-      choices: ["public", "confidential"]
-      type: str
-      required: False
-    organization:
-      description:
-        - Name, ID, or named URL of organization for application.
-      type: str
-      required: True
-    redirect_uris:
-      description:
-        - Allowed urls list, space separated. Required when authorization-grant-type=authorization-code
-      type: list
-      elements: str
-    state:
-      description:
-        - Desired state of the resource.
-      default: "present"
-      choices: ["present", "absent", "exists"]
-      type: str
-    skip_authorization:
-      description:
-        - Set True to skip authorization step for completely trusted applications.
-      type: bool
-
-extends_documentation_fragment: awx.awx.auth
-'''
-
-
-EXAMPLES = '''
-- name: Add Foo application
-  application:
-    name: "Foo"
-    description: "Foo bar application"
-    organization: "test"
-    state: present
-    authorization_grant_type: password
-    client_type: public
-
-- name: Add Foo application
-  application:
-    name: "Foo"
-    description: "Foo bar application"
-    organization: "test"
-    state: present
-    authorization_grant_type: authorization-code
-    client_type: confidential
-    redirect_uris:
-      - http://tower.com/api/v2/
-'''
-
-from ..module_utils.controller_api import ControllerAPIModule
-
-
-def main():
-    # Any additional arguments that are not fields of the item can be added here
-    argument_spec = dict(
-        name=dict(required=True),
-        new_name=dict(),
-        description=dict(),
-        authorization_grant_type=dict(choices=["password", "authorization-code"]),
-        client_type=dict(choices=['public', 'confidential']),
-        organization=dict(required=True),
-        redirect_uris=dict(type="list", elements='str'),
-        state=dict(choices=['present', 'absent', 'exists'], default='present'),
-        skip_authorization=dict(type='bool'),
-    )
-
-    # Create a module for ourselves
-    module = ControllerAPIModule(argument_spec=argument_spec)
-
-    # Extract our parameters
-    name = module.params.get('name')
-    new_name = module.params.get("new_name")
-    description = module.params.get('description')
-    authorization_grant_type = module.params.get('authorization_grant_type')
-    client_type = module.params.get('client_type')
-    organization = module.params.get('organization')
-    redirect_uris = module.params.get('redirect_uris')
-    skip_authorization = module.params.get('skip_authorization')
-    state = module.params.get('state')
-
-    # Attempt to look up the related items the user specified (these will fail the module if not found)
-    org_id = module.resolve_name_to_id('organizations', organization)
-
-    # Attempt to look up application based on the provided name and org ID
-    application = module.get_one('applications', name_or_id=name, check_exists=(state == 'exists'), **{'data': {'organization': org_id}})
-
-    if state == 'absent':
-        # If the state was absent we can let the module delete it if needed, the module will handle exiting from this
-        module.delete_if_needed(application)
-
-    # Create the data that gets sent for create and update
-    application_fields = {
-        'name': new_name if new_name else (module.get_item_name(application) if application else name),
-        'organization': org_id,
-    }
-    if authorization_grant_type is not None:
-        application_fields['authorization_grant_type'] = authorization_grant_type
-    if client_type is not None:
-        application_fields['client_type'] = client_type
-    if description is not None:
-        application_fields['description'] = description
-    if redirect_uris is not None:
-        application_fields['redirect_uris'] = ' '.join(redirect_uris)
-    if skip_authorization is not None:
-        application_fields['skip_authorization'] = skip_authorization
-
-    response = module.create_or_update_if_needed(application, application_fields, endpoint='applications', item_type='application', auto_exit=False)
-    if 'client_id' in response:
-        module.json_output['client_id'] = response['client_id']
-    if 'client_secret' in response:
-        module.json_output['client_secret'] = response['client_secret']
-    module.exit_json(**module.json_output)
-
-
-if __name__ == '__main__':
-    main()
diff --git a/awx_collection/plugins/modules/token.py b/awx_collection/plugins/modules/token.py
deleted file mode 100644
index b6e13cd02c..0000000000
--- a/awx_collection/plugins/modules/token.py
+++ /dev/null
@@ -1,208 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-
-
-# (c) 2020, John Westcott IV <john.westcott.iv@redhat.com>
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-
-ANSIBLE_METADATA = {'metadata_version': '1.1', 'status': ['preview'], 'supported_by': 'community'}
-
-DOCUMENTATION = '''
----
-module: token
-author: "John Westcott IV (@john-westcott-iv)"
-version_added: "2.3.0"
-short_description: create, update, or destroy Automation Platform Controller tokens.
-description:
-    - Create or destroy Automation Platform Controller tokens. See
-      U(https://www.ansible.com/tower) for an overview.
-    - In addition, the module sets an Ansible fact which can be passed into other
-      controller modules as the parameter controller_oauthtoken. See examples for usage.
-    - Because of the sensitive nature of tokens, the created token value is only available once
-      through the Ansible fact. (See RETURN for details)
-    - Due to the nature of tokens this module is not idempotent. A second will
-      with the same parameters will create a new token.
-    - If you are creating a temporary token for use with modules you should delete the token
-      when you are done with it. See the example for how to do it.
-options:
-    description:
-      description:
-        - Optional description of this access token.
-      required: False
-      type: str
-    application:
-      description:
-        - The application name, ID, or named URL tied to this token.
-      required: False
-      type: str
-    scope:
-      description:
-        - Allowed scopes, further restricts user's permissions. Must be a simple space-separated string with allowed scopes ['read', 'write'].
-      required: False
-      type: str
-      choices: ["read", "write"]
-    existing_token:
-      description: The data structure produced from token in create mode to be used with state absent.
-      type: dict
-    existing_token_id:
-      description: A token ID (number) which can be used to delete an arbitrary token with state absent.
-      type: str
-    state:
-      description:
-        - Desired state of the resource.
-      choices: ["present", "absent"]
-      default: "present"
-      type: str
-extends_documentation_fragment: awx.awx.auth
-'''
-
-EXAMPLES = '''
-- block:
-    - name: Create a new token using an existing token
-      token:
-        description: '{{ token_description }}'
-        scope: "write"
-        state: present
-        controller_oauthtoken: "{{ my_existing_token }}"
-
-    - name: Delete this token
-      token:
-        existing_token: "{{ controller_token }}"
-        state: absent
-
-    - name: Create a new token using username/password
-      token:
-        description: '{{ token_description }}'
-        scope: "write"
-        state: present
-        controller_username: "{{ my_username }}"
-        controller_password: "{{ my_password }}"
-
-    - name: Use our new token to make another call
-      job_list:
-        controller_oauthtoken: "{{ controller_token }}"
-
-  always:
-    - name: Delete our Token with the token we created
-      token:
-        existing_token: "{{ controller_token }}"
-        state: absent
-      when: token is defined
-
-- name: Delete a token by its id
-  token:
-    existing_token_id: 4
-    state: absent
-'''
-
-RETURN = '''
-controller_token:
-  type: dict
-  description: An Ansible Fact variable representing a token object which can be used for auth in subsequent modules. See examples for usage.
-  contains:
-    token:
-      description: The token that was generated. This token can never be accessed again, make sure this value is noted before it is lost.
-      type: str
-    id:
-      description: The numeric ID of the token created
-      type: str
-  returned: on successful create
-'''
-
-from ..module_utils.controller_api import ControllerAPIModule
-
-
-def return_token(module, last_response):
-    # A token is special because you can never get the actual token ID back from the API.
-    # So the default module return would give you an ID but then the token would forever be masked on you.
-    # This method will return the entire token object we got back so that a user has access to the token
-
-    module.json_output['ansible_facts'] = {
-        'controller_token': last_response,
-        'tower_token': last_response,
-    }
-    module.exit_json(**module.json_output)
-
-
-def main():
-    # Any additional arguments that are not fields of the item can be added here
-    argument_spec = dict(
-        description=dict(),
-        application=dict(),
-        scope=dict(choices=['read', 'write']),
-        existing_token=dict(type='dict', no_log=False),
-        existing_token_id=dict(),
-        state=dict(choices=['present', 'absent'], default='present'),
-    )
-
-    # Create a module for ourselves
-    module = ControllerAPIModule(
-        argument_spec=argument_spec,
-        mutually_exclusive=[
-            ('existing_token', 'existing_token_id'),
-        ],
-        # If we are state absent make sure one of existing_token or existing_token_id are present
-        required_if=[
-            [
-                'state',
-                'absent',
-                ('existing_token', 'existing_token_id'),
-                True,
-            ],
-        ],
-    )
-
-    # Extract our parameters
-    description = module.params.get('description')
-    application = module.params.get('application')
-    scope = module.params.get('scope')
-    existing_token = module.params.get('existing_token')
-    existing_token_id = module.params.get('existing_token_id')
-    state = module.params.get('state')
-
-    if state == 'absent':
-        if not existing_token:
-            existing_token = module.get_one(
-                'tokens',
-                **{
-                    'data': {
-                        'id': existing_token_id,
-                    }
-                }
-            )
-
-        # If the state was absent we can let the module delete it if needed, the module will handle exiting from this
-        module.delete_if_needed(existing_token)
-
-    # Attempt to look up the related items the user specified (these will fail the module if not found)
-    application_id = None
-    if application:
-        application_id = module.resolve_name_to_id('applications', application)
-
-    # Create the data that gets sent for create and update
-    new_fields = {}
-    if description is not None:
-        new_fields['description'] = description
-    if application is not None:
-        new_fields['application'] = application_id
-    if scope is not None:
-        new_fields['scope'] = scope
-
-    # If the state was present and we can let the module build or update the existing item, this will return on its own
-    module.create_or_update_if_needed(
-        None,
-        new_fields,
-        endpoint='tokens',
-        item_type='token',
-        associations={},
-        on_create=return_token,
-    )
-
-
-if __name__ == '__main__':
-    main()
diff --git a/awx_collection/test/awx/test_application.py b/awx_collection/test/awx/test_application.py
deleted file mode 100644
index c93e2f3333..0000000000
--- a/awx_collection/test/awx/test_application.py
+++ /dev/null
@@ -1,29 +0,0 @@
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-import pytest
-
-from awx.main.models import Organization
-from awx.main.models.oauth import OAuth2Application
-
-
-@pytest.mark.django_db
-def test_create_application(run_module, admin_user):
-    org = Organization.objects.create(name='foo')
-
-    module_args = {
-        'name': 'foo_app',
-        'description': 'barfoo',
-        'state': 'present',
-        'authorization_grant_type': 'password',
-        'client_type': 'public',
-        'organization': 'foo',
-    }
-
-    result = run_module('application', module_args, admin_user)
-    assert result.get('changed'), result
-
-    application = OAuth2Application.objects.get(name='foo_app')
-    assert application.description == 'barfoo'
-    assert application.organization_id == org.id
diff --git a/awx_collection/test/awx/test_completeness.py b/awx_collection/test/awx/test_completeness.py
index 42d013df6c..132e2bb4e0 100644
--- a/awx_collection/test/awx/test_completeness.py
+++ b/awx_collection/test/awx/test_completeness.py
@@ -21,7 +21,9 @@ read_only_endpoints_with_modules = ['settings', 'role', 'project_update', 'workf
 # If a module should not be created for an endpoint and the endpoint is not read-only add it here
 # THINK HARD ABOUT DOING THIS
 no_module_for_endpoint = [
+    'application',  # Usage of OAuth tokens is deprecated
     'constructed_inventory',  # This is a view for inventory with kind=constructed
+    'token',  # Usage of OAuth tokens is deprecated
 ]
 
 # Some modules work on the related fields of an endpoint. These modules will not have an auto-associated endpoint
@@ -61,8 +63,6 @@ ignore_parameters = ['state', 'new_name', 'update_secrets', 'copy_from', 'is_int
 no_api_parameter_ok = {
     # The wait is for whether or not to wait for a project update on change
     'project': ['wait', 'interval', 'update_project'],
-    # Existing_token and id are for working with an existing tokens
-    'token': ['existing_token', 'existing_token_id'],
     # /survey spec is now how we handle associations
     # We take an organization here to help with the lookups only
     'job_template': ['survey_spec', 'organization'],
diff --git a/awx_collection/test/awx/test_organization.py b/awx_collection/test/awx/test_organization.py
index e6b3cc5e2d..a38ca3dbe1 100644
--- a/awx_collection/test/awx/test_organization.py
+++ b/awx_collection/test/awx/test_organization.py
@@ -20,7 +20,6 @@ def test_create_organization(run_module, admin_user):
         'controller_username': None,
         'controller_password': None,
         'validate_certs': None,
-        'controller_oauthtoken': None,
         'controller_config_file': None,
     }
 
@@ -53,7 +52,6 @@ def test_galaxy_credential_order(run_module, admin_user):
         'controller_username': None,
         'controller_password': None,
         'validate_certs': None,
-        'controller_oauthtoken': None,
         'controller_config_file': None,
         'galaxy_credentials': cred_ids,
     }
@@ -78,7 +76,6 @@ def test_galaxy_credential_order(run_module, admin_user):
         'controller_username': None,
         'controller_password': None,
         'validate_certs': None,
-        'controller_oauthtoken': None,
         'controller_config_file': None,
         'galaxy_credentials': cred_ids,
     }
diff --git a/awx_collection/tests/integration/targets/application/tasks/main.yml b/awx_collection/tests/integration/targets/application/tasks/main.yml
deleted file mode 100644
index e2e82eab82..0000000000
--- a/awx_collection/tests/integration/targets/application/tasks/main.yml
+++ /dev/null
@@ -1,131 +0,0 @@
----
-- name: Generate a test id
-  set_fact:
-    test_id: "{{ lookup('password', '/dev/null chars=ascii_letters length=16') }}"
-  when: test_id is not defined
-
-- name: Generate names
-  set_fact:
-    app1_name: "AWX-Collection-tests-application-app1-{{ test_id }}"
-    app2_name: "AWX-Collection-tests-application-app2-{{ test_id }}"
-    app3_name: "AWX-Collection-tests-application-app3-{{ test_id }}"
-
-- block:
-    - name: Create an application
-      application:
-        name: "{{ app1_name }}"
-        authorization_grant_type: "password"
-        client_type: "public"
-        organization: "Default"
-        state: present
-      register: result
-
-    - assert:
-        that:
-          - "result is changed"
-
-    - name: Run an application with exists
-      application:
-        name: "{{ app1_name }}"
-        authorization_grant_type: "password"
-        client_type: "public"
-        organization: "Default"
-        state: exists
-      register: result
-
-    - assert:
-        that:
-          - "result is not changed"
-
-    - name: Delete our application
-      application:
-        name: "{{ app1_name }}"
-        organization: "Default"
-        state: absent
-      register: result
-
-    - assert:
-        that:
-          - "result is changed"
-
-    - name: Run an application with exists
-      application:
-        name: "{{ app1_name }}"
-        authorization_grant_type: "password"
-        client_type: "public"
-        organization: "Default"
-        state: exists
-      register: result
-
-    - assert:
-        that:
-          - "result is changed"
-
-    - name: Delete our application
-      application:
-        name: "{{ app1_name }}"
-        organization: "Default"
-        state: absent
-      register: result
-
-    - assert:
-        that:
-          - "result is changed"
-
-    - name: Create a second application
-      application:
-        name: "{{ app2_name }}"
-        authorization_grant_type: "authorization-code"
-        client_type: "confidential"
-        organization: "Default"
-        description: "Another application"
-        redirect_uris:
-          - http://tower.com/api/v2/
-          - http://tower.com/api/v2/teams
-        state: present
-      register: result
-
-    - assert:
-        that:
-          - "result is changed"
-
-    - name: Create an all trusting application
-      application:
-        name: "{{ app3_name }}"
-        organization: "Default"
-        description: "All Trusting Application"
-        skip_authorization: true
-        authorization_grant_type: "password"
-        client_type: "confidential"
-        state: present
-      register: result
-
-    - assert:
-        that:
-          - "result is changed"
-          - "'client_secret' in result"
-
-    - name: Rename an inventory
-      application:
-        name: "{{ app3_name }}"
-        new_name: "{{ app3_name }}a"
-        organization: Default
-        state: present
-      register: result
-
-    - assert:
-        that:
-          - result.changed
-
-  always:
-    - name: Delete our application
-      application:
-        name: "{{ item }}"
-        organization: "Default"
-        state: absent
-      register: result
-      loop:
-        - "{{ app1_name }}"
-        - "{{ app2_name }}"
-        - "{{ app3_name }}"
-        - "{{ app3_name }}a"
diff --git a/awx_collection/tests/integration/targets/token/tasks/main.yml b/awx_collection/tests/integration/targets/token/tasks/main.yml
deleted file mode 100644
index 9cd4972a93..0000000000
--- a/awx_collection/tests/integration/targets/token/tasks/main.yml
+++ /dev/null
@@ -1,115 +0,0 @@
----
-- name: Generate a test ID
-  set_fact:
-    test_id: "{{ lookup('password', '/dev/null chars=ascii_letters length=16') }}"
-  when: test_id is not defined
-
-- name: Generate names
-  set_fact:
-    token_description: "AWX-Collection-tests-token-description-{{ test_id }}"
-
-- name: Try to use a token as a dict which is missing the token parameter
-  job_list:
-    controller_oauthtoken:
-      not_token: "This has no token entry"
-  register: results
-  ignore_errors: true
-
-- assert:
-    that:
-      - results is failed
-      - '"The provided dict in controller_oauthtoken did not properly contain the token entry" == results.msg'
-
-- name: Try to use a token as a list
-  job_list:
-    controller_oauthtoken:
-      - dummy_token
-  register: results
-  ignore_errors: true
-
-- assert:
-    that:
-      - results is failed
-      - '"The provided controller_oauthtoken type was not valid (list). Valid options are str or dict." == results.msg'
-
-- name: Try to delete a token with no existing_token or existing_token_id
-  token:
-    state: absent
-  register: results
-  ignore_errors: true
-
-- assert:
-    that:
-      - results is failed
-      # We don't assert a message here because it's handled by ansible
-
-- name: Try to delete a token with both existing_token or existing_token_id
-  token:
-    existing_token:
-      id: 1234
-    existing_token_id: 1234
-    state: absent
-  register: results
-  ignore_errors: true
-
-- assert:
-    that:
-      - results is failed
-      # We don't assert a message here because it's handled by ansible
-
-
-- block:
-    - name: Create a Token
-      token:
-        description: '{{ token_description }}'
-        scope: "write"
-        state: present
-      register: new_token
-
-    - name: Validate our token works by token
-      job_list:
-        controller_oauthtoken: "{{ controller_token.token }}"
-      register: job_list
-
-    - name: Validate our token works by object
-      job_list:
-        controller_oauthtoken: "{{ controller_token }}"
-      register: job_list
-
-  always:
-    - name: Delete our Token with our own token
-      token:
-        existing_token: "{{ controller_token }}"
-        controller_oauthtoken: "{{ controller_token }}"
-        state: absent
-      when: controller_token is defined
-      register: results
-
-    - assert:
-        that:
-          - results is changed or results is skipped
-
-- block:
-    - name: Create a second token
-      token:
-        description: '{{ token_description }}'
-        scope: "write"
-        state: present
-      register: results
-
-    - assert:
-        that:
-          - results is changed
-
-  always:
-    - name: Delete the second Token with our own token
-      token:
-        existing_token_id: "{{ controller_token['id'] }}"
-        controller_oauthtoken: "{{ controller_token }}"
-        state: absent
-      when: controller_token is defined
-      register: results
-
-    - assert:
-        that:
-          - results is changed or resuslts is skipped
diff --git a/awx_collection/tests/integration/targets/user/tasks/main.yml b/awx_collection/tests/integration/targets/user/tasks/main.yml
index a3fae666b0..2d88bb199a 100644
--- a/awx_collection/tests/integration/targets/user/tasks/main.yml
+++ b/awx_collection/tests/integration/targets/user/tasks/main.yml
@@ -220,7 +220,6 @@
       user:
         controller_username: "{{ username }}-orgadmin"
         controller_password: "{{ username }}-orgadmin"
-        controller_oauthtoken: false  # Hack for CI where we use oauth in config file
         username: "{{ username }}"
         first_name: Joe
         password: "{{ 65535 | random | to_uuid }}"
diff --git a/awx_collection/tools/roles/generate/templates/module.j2 b/awx_collection/tools/roles/generate/templates/module.j2
index 57e6bc4c77..6efe6340e9 100644
--- a/awx_collection/tools/roles/generate/templates/module.j2
+++ b/awx_collection/tools/roles/generate/templates/module.j2
@@ -82,11 +82,6 @@ options:
       choices: ["present", "absent"]
       default: "present"
       type: str
-    controller_oauthtoken:
-      description:
-        - The OAuth token to use.
-      required: False
-      type: str
 extends_documentation_fragment: awx.awx.auth
 '''
 
diff --git a/awx_collection/tools/roles/template_galaxy/templates/README.md.j2 b/awx_collection/tools/roles/template_galaxy/templates/README.md.j2
index e7c232b263..def1d0c64d 100644
--- a/awx_collection/tools/roles/template_galaxy/templates/README.md.j2
+++ b/awx_collection/tools/roles/template_galaxy/templates/README.md.j2
@@ -37,11 +37,28 @@ This collection should be installed from [Content Hub](https://cloud.redhat.com/
 ## Running
 
 Non-deprecated modules in this collection have no Python requirements, but
-may require the AWX CLI
+may require the official [AWX CLI](https://pypi.org/project/awxkit/)
 in the future. The `DOCUMENTATION` for each module will report this.
 
 You can specify authentication by host, username, and password.
 
+These can be specified via (from highest to lowest precedence):
+
+ - direct module parameters
+ - environment variables (most useful when running against localhost)
+ - a config file path specified by the `tower_config_file` parameter
+ - a config file at `~/.tower_cli.cfg`
+ - a config file at `/etc/tower/tower_cli.cfg`
+
+Config file syntax looks like this:
+
+```
+[general]
+host = https://localhost:8043
+verify_ssl = true
+username = foo
+password = bar
+```
 
 ## Release and Upgrade Notes
 
@@ -52,12 +69,14 @@ Notable releases of the `{{ collection_namespace }}.{{ collection_package }}` co
  - 11.0.0 has no non-deprecated modules that depend on the deprecated `tower-cli` [PyPI](https://pypi.org/project/ansible-tower-cli/).
  - 19.2.1 large renaming purged "tower" names (like options and module names), adding redirects for old names
  - 21.11.0 "tower" modules deprecated and symlinks removed.
+ - 25.0.0 "token" and "application" modules have been removed as oauth is no longer supported, use basic auth instead
  - X.X.X added support of named URLs to all modules. Anywhere that previously accepted name or id can also support named URLs
  - 0.0.1-devel is the version you should see if installing from source, which is intended for development and expected to be unstable.
 {% else %}
  - 3.7.0 initial release
  - 4.0.0 ansible.tower renamed to ansible.controller
    - tower_ prefix is dropped from the module names, e.g. tower_inventory becomes inventory
+ - 4.7.0 "token" module has been removed as oauth is no longer supported, use basic auth instead
 {% endif %}
 
 The following notes are changes that may require changes to playbooks:
@@ -90,7 +109,7 @@ The following notes are changes that may require changes to playbooks:
  - The `notification_configuration` parameter of `tower_notification_template` has changed from a string to a dict. Please use the `lookup` plugin to read an existing file into a dict.
  - `tower_credential` no longer supports passing a file name to `ssh_key_data`.
  - The HipChat `notification_type` has been removed and can no longer be created using the `tower_notification_template` module.
- - Lookup plugins now always reutrn a list, and if you want a scalar value use `lookup` as opposed to `query`
+ - Lookup plugins now always return a list, and if you want a scalar value use `lookup` as opposed to `query`
 
 {% if collection_package | lower() == "awx" %}
 ## Running Unit Tests