python-oracledb 3.4.0 does not parse Azure Entra ID tokens correctly

[Maros112358]

1. What versions are you using?

3.4.0

2. Is it an error or a hang or a crash?

Error.

3. What error(s) or behavior you are seeing?

Traceback (most recent call last):
  File "src/oracledb/impl/base/connect_params.pyx", line 367, in oracledb.base_impl.ConnectParamsImpl._set_access_token
  File "src/oracledb/impl/base/connect_params.pyx", line 294, in oracledb.base_impl.ConnectParamsImpl._get_token_expires
  File "/Users/maros/.pyenv/versions/3.10.13/lib/python3.10/base64.py", line 87, in b64decode
    return binascii.a2b_base64(s)
binascii.Error: Incorrect padding

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/Users/maros/Gitlab/dagster/data-ops/test.py", line 12, in <module>
    conn = oracledb.connect(
  File "/Users/maros/Library/Caches/pypoetry/virtualenvs/data-ops-pkPRkd2D-py3.10/lib/python3.10/site-packages/oracledb/connection.py", line 1698, in connect
    return conn_class(dsn=dsn, pool=pool, params=params, **kwargs)
  File "/Users/maros/Library/Caches/pypoetry/virtualenvs/data-ops-pkPRkd2D-py3.10/lib/python3.10/site-packages/oracledb/connection.py", line 868, in __init__
    dsn = params_impl.process_args(dsn, kwargs, thin)
  File "src/oracledb/impl/base/connect_params.pyx", line 567, in oracledb.base_impl.ConnectParamsImpl.process_args
  File "src/oracledb/impl/base/connect_params.pyx", line 109, in oracledb.base_impl.ConnectParamsImpl.set
  File "src/oracledb/impl/base/connect_params.pyx", line 387, in oracledb.base_impl.ConnectParamsImpl._set_access_token_param
  File "src/oracledb/impl/base/connect_params.pyx", line 369, in oracledb.base_impl.ConnectParamsImpl._set_access_token
  File "/Users/maros/Library/Caches/pypoetry/virtualenvs/data-ops-pkPRkd2D-py3.10/lib/python3.10/site-packages/oracledb/errors.py", line 199, in _raise_err
    raise error.exc_type(error) from cause
oracledb.exceptions.ProgrammingError: DPY-2031: invalid access token: value must be a string (for OAuth), a 2-tuple containing the token and private key strings (for IAM), or a callable that returns a string or 2-tuple
Incorrect padding

4. Does your application call init_oracle_client()?

No.

5. Include a runnable Python script that shows the problem.

import oracledb
import azure.identity

access_token = azure.identity.DefaultAzureCredential().get_token("https://<hostname>/<db_name>/.default").token
conn = oracledb.connect(
    host="<db_host>",
    service_name="<db_service_name>",
    access_token=access_token,
)
with conn.cursor() as cursor:
    r = cursor.execute("SELECt 1 from dual").fetchall()
    print(r)

[savansonii]

It seems the string you’re decoding with binascii.a2b_base64() isn’t correctly padded or formatted as valid Base64, which is causing this issue.

[Maros112358]

Hello @savansonii, I contacted Azure Support about this matter and according to them, the Entra ID tokens are correct. I can also confirm that the newest Oracle JDBC Driver 23.26.0.0 parses them correctly. Here's the response from Azure Support:

Root Cause:
The problem is not with Azure OAuth or the tokens themselves. Azure issues JWT tokens according to the industry standard > (Base64URL encoding without padding). However, the Oracle client/driver currently in use expects padded Base64 segments > and fails to parse tokens without padding, resulting in the “incorrect padding” error. When padding is manually added, the > token signature becomes invalid, and Oracle correctly rejects it.
Resolution:
To resolve this, please ensure you are using Oracle client components that support Azure-issued tokens and Base64URL encoding correctly
Upgrade Oracle JDBC / Instant Client to version 23.4 or later (preferably 23.5+).
If using JDBC thin, include the ojdbc-provider-azure extension for proper token handling.
Do not modify the token manually, any changes invalidate the signature.

Based on this I assume python-oracledb does not parse the Azure Entra ID tokens correctly and assumes they are padded, while Azure Support confirmed they are not padded according to industry standard Base64URL encoding without padding. I assume that this can be fixed by using a Base64URL decoding method in python-oracledb.

[Maros112358]

I created a PR with the fix. To avoid the complicated approval process, please create your own PR with the fix. I tested it locally with tokens from Azure EntraID (which triggered the reported error), and the fix resolved the issue successfully.