python-oracledb 3.4.0 does not parse Azure Entra ID tokens correctly

[Maros112358]

1. What versions are you using?

3.4.0

2. Is it an error or a hang or a crash?

Error.

3. What error(s) or behavior you are seeing?

Traceback (most recent call last):
  File "src/oracledb/impl/base/connect_params.pyx", line 367, in oracledb.base_impl.ConnectParamsImpl._set_access_token
  File "src/oracledb/impl/base/connect_params.pyx", line 294, in oracledb.base_impl.ConnectParamsImpl._get_token_expires
  File "/Users/maros/.pyenv/versions/3.10.13/lib/python3.10/base64.py", line 87, in b64decode
    return binascii.a2b_base64(s)
binascii.Error: Incorrect padding

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/Users/maros/Gitlab/dagster/data-ops/test.py", line 12, in <module>
    conn = oracledb.connect(
  File "/Users/maros/Library/Caches/pypoetry/virtualenvs/data-ops-pkPRkd2D-py3.10/lib/python3.10/site-packages/oracledb/connection.py", line 1698, in connect
    return conn_class(dsn=dsn, pool=pool, params=params, **kwargs)
  File "/Users/maros/Library/Caches/pypoetry/virtualenvs/data-ops-pkPRkd2D-py3.10/lib/python3.10/site-packages/oracledb/connection.py", line 868, in __init__
    dsn = params_impl.process_args(dsn, kwargs, thin)
  File "src/oracledb/impl/base/connect_params.pyx", line 567, in oracledb.base_impl.ConnectParamsImpl.process_args
  File "src/oracledb/impl/base/connect_params.pyx", line 109, in oracledb.base_impl.ConnectParamsImpl.set
  File "src/oracledb/impl/base/connect_params.pyx", line 387, in oracledb.base_impl.ConnectParamsImpl._set_access_token_param
  File "src/oracledb/impl/base/connect_params.pyx", line 369, in oracledb.base_impl.ConnectParamsImpl._set_access_token
  File "/Users/maros/Library/Caches/pypoetry/virtualenvs/data-ops-pkPRkd2D-py3.10/lib/python3.10/site-packages/oracledb/errors.py", line 199, in _raise_err
    raise error.exc_type(error) from cause
oracledb.exceptions.ProgrammingError: DPY-2031: invalid access token: value must be a string (for OAuth), a 2-tuple containing the token and private key strings (for IAM), or a callable that returns a string or 2-tuple
Incorrect padding

4. Does your application call init_oracle_client()?

No.

5. Include a runnable Python script that shows the problem.

import oracledb
import azure.identity

access_token = azure.identity.DefaultAzureCredential().get_token("https://<hostname>/<db_name>/.default").token
conn = oracledb.connect(
    host="<db_host>",
    service_name="<db_service_name>",
    access_token=access_token,
)
with conn.cursor() as cursor:
    r = cursor.execute("SELECt 1 from dual").fetchall()
    print(r)

[savansonii]

It seems the string you’re decoding with binascii.a2b_base64() isn’t correctly padded or formatted as valid Base64, which is causing this issue.

[Maros112358]

Hello @savansonii, I contacted Azure Support about this matter and according to them, the Entra ID tokens are correct. I can also confirm that the newest Oracle JDBC Driver 23.26.0.0 parses them correctly. Here's the response from Azure Support:

Root Cause:
The problem is not with Azure OAuth or the tokens themselves. Azure issues JWT tokens according to the industry standard > (Base64URL encoding without padding). However, the Oracle client/driver currently in use expects padded Base64 segments > and fails to parse tokens without padding, resulting in the “incorrect padding” error. When padding is manually added, the > token signature becomes invalid, and Oracle correctly rejects it.
Resolution:
To resolve this, please ensure you are using Oracle client components that support Azure-issued tokens and Base64URL encoding correctly
Upgrade Oracle JDBC / Instant Client to version 23.4 or later (preferably 23.5+).
If using JDBC thin, include the ojdbc-provider-azure extension for proper token handling.
Do not modify the token manually, any changes invalidate the signature.

Based on this I assume python-oracledb does not parse the Azure Entra ID tokens correctly and assumes they are padded, while Azure Support confirmed they are not padded according to industry standard Base64URL encoding without padding. I assume that this can be fixed by using a Base64URL decoding method in python-oracledb.

[Maros112358]

I created a PR with the fix. To avoid the complicated approval process, please create your own PR with the fix. I tested it locally with tokens from Azure EntraID (which triggered the reported error), and the fix resolved the issue successfully.

[vladidobro]

Hello,

I too have looked into this, and I am a little bit confused by the code the code that @Maros112358 fixes in his PR, namely the function

    cdef object _get_token_expires(self, str token):
        """
        Gets the expiry date from the token.
        """
        cdef:
            str header_seg
            dict header
            int num_pad
        header_seg = token.split(".")[1]
        num_pad = len(header_seg) % 4
        if num_pad != 0:
            header_seg += '=' * num_pad
        header = json.loads(base64.b64decode(header_seg))
        return datetime.datetime.utcfromtimestamp(header["exp"])

The part

        num_pad = len(header_seg) % 4
        if num_pad != 0:
            header_seg += '=' * num_pad

seems to try to compute and add the needed padding, but I think that the padding is wrong, the last line should instead read

        header_seg += '=' * (4 - num_pad)

I don't know how this line could have worked before, so maybe I am in the wrong here.

Also, the token that comes from azure.DefaultAzureCredential.get_token is not standard base64, but instead base64url.
I don't know about other OAuth providers, but at least my tokens (which correctly authenticate me in the database) contain the characters '-' and '_'.
So the use of base64.b64decode is wrong, because it simply ignores these characters

In [38]: base64.b64decode('eye=_-_')
Out[38]: b"{'"

In [39]: base64.b64decode('eye=')
Out[39]: b"{'"

On the other hand, using urlsafe_b64decode as @Maros112358 suggests, interprets correctly the '_', '-' characters, but is also compatible with the standard b64decode and so interprets the '/' and '+' characters correctly as well.

Even though the base64url standard states that padding is unnecessary and should be filled automatically, the python implementation of urlsafe_b64decode does raise error on incorrect padding, but what's weird is that it requires at least the correct padding, but strips all unnecessary padding

In [8]: base64.urlsafe_b64decode('ey00abc')  # length 7 - invalid
Error: Incorrect padding

In [9]: base64.urlsafe_b64decode('ey00abc=')  # length 8 - valid
Out[9]: b'{-4i\xb7'

In [10]: base64.urlsafe_b64decode('ey00abc==')  # length 9 - invalid, but python does not raise
Out[10]: b'{-4i\xb7'

so I think that this peculiar implementation detail partially hides the bug with incorrect padding in oracledb-python.

I suggest the fixed function looks like this

    cdef object _get_token_expires(self, str token):
        """
        Gets the expiry date from the token.
        """
        cdef:
            str header_seg
            dict header
            int num_pad
        header_seg = token.split(".")[1]
        num_pad = len(header_seg) % 4
        if num_pad != 0:
            header_seg += '=' * (4 - num_pad)
        header = json.loads(base64.urlsafe_b64decode(header_seg))
        return datetime.datetime.utcfromtimestamp(header["exp"])

(I have not tested it)

[anthony-tuininga]

@Maros112358, does this comment suggest your PR should be adjusted? Did you test it yourself? I have asked for this to be tested internally. Apologies for the delay!

[Maros112358]

Hello @anthony-tuininga, yes, please. I tested it with the same token both in python-oracledb=3.4.0 and with the _get_token_expires that @vladidobro described. In python-oracledb=3.4.0 the access_token threw the error I mentioned in the first post, and worked correctly with the _get_token_expires function from @vladidobro:

    cdef object _get_token_expires(self, str token):
        """
        Gets the expiry date from the token.
        """
        cdef:
            str header_seg
            dict header
            int num_pad
        header_seg = token.split(".")[1]
        num_pad = len(header_seg) % 4
        if num_pad != 0:
            header_seg += '=' * (4 - num_pad)
        header = json.loads(base64.urlsafe_b64decode(header_seg))
        return datetime.datetime.utcfromtimestamp(header["exp"])

[anthony-tuininga]

I have pushed a patch that should correct this issue and have initated a build from which you can download pre-built development wheels once it completes. You can also build from source if you prefer. If you can test your scenario and confirm the patch works as expected, that would be appreciated!