Examples of Retrieving Entra ID OAuth2 Tokens Outside an Oracle Database Client

These examples show different ways that you can retrieve Entra ID OAuth2 token separately from the database client if you are not using the database client to retrieve the tokens directly.

About Examples of Retrieving Microsoft Entra ID OAuth2 Tokens Outside of an Oracle Database Client

Oracle Database clients have differing abilities in directly retrieving an Entra ID OAuth2 token.

Review the specific client documentation for configuring the database client to retrieve tokens for different flows. The other two ways to work with Entra ID tokens are as follows:

Review the client documentation on using the API. A utility or script is used to request a token from Entra ID and store it in a file location for the database client to pick up. Using a script or utility to request and store the token is outside Oracle Database. There are many examples available from Microsoft and others on the internet on how to get an Entra ID token. (Also search for Azure AD OAuth2 token). The samples in this section are just some examples and not supported by Oracle.

Example: Requesting a Token Using a Python Script for the Interactive (Authorization) Flow

The interactive (authorization) flow is the most common for human users to access the database.

If the user has not already logged into their Azure account, they will be prompted with a web page to enter their Azure credentials. They will also need to complete any multi-factor authentication required by the organization before they retrieve the database OAuth2 access token. This example with the Microsoft Authentication Library (MSAL) is in Python and can be run on a variety of platforms such as Windows PowerShell and Linux. Because the authorization flow requires two round trips to Azure AD, it is best handled using the MSAL. See the Microsoft article Get Entra ID tokens by using the Microsoft Authentication Library for how to use a python script with MSAL. These instructions are for the Databricks service, but the scope is changed to the database App ID URI and scope instead of the Databricks scope.

  1. Bypass the steps to set up the client app registration, since you have already accomplished that step except make sure you add a Redirect URI (http://localhost) for your client app registration.

  2. Go directly to Get Entra ID tokens by using the MSAL Python library.

    You will need the Directory (tenant) ID, Client ID for the public app client, and the database App ID URI and scope. You will see a code section for scopes with directions to not modify this variable. Because this python code was written for Databricks scope, you will need to change this scope variable to the scope of your database. For example:

    scopes = ['https://example.com/1111aa1a-a1aa-1a11-11aa-1a1a11aa1111/session:connect']

  3. Modify the code to write the token to a file location.

    Use the following example code and append it to the print statements at the end. Note the extra lines to back up and restore the original stdout.

    stdout_backup = sys.stdout
with open('token', 'w') as token_file:
    sys.stdout = token_file
    print(acquire_tokens_result['access_token'])

sys.stdout = stdout_backup

Example: Requesting a Token Using Azure CLI for the Interactive (Authorization) Flow

This example shows how to use the Azure CLI to retrieve an access token and then write the token to a file.

See the Microsoft article Install the Azure CLI on Linux for information about installing the Azure CLI.

  1. Log in to your Azure tenancy.

    $ az login

  2. Get an access token and assign it to the token variable using the following syntax:

    token=$(az account get-access-token --resource=database_app_id_uri --query accessToken --output tsv)

    For example:

    token=$(az account get-access-token --resource=https://example.com/1111aa1a-a1aa-1a11-11aa-1a1a11aa1111 --query accessToken --output tsv)

    If you get an Azure CLI error saying that the client app ID does not have permission to access the database resource, then copy the client app ID from the error message and add it to the list of authorized client applications for the database resource. (Go to the database app registration in Entra ID, click Expose an API and then Add a client application).

  3. Write the token to a file.

    $ echo "$token" >> token

Requesting a Token Using the Azure CLI for the Client Credential Flow

The client credential flow is used for applications that need to use an Entra ID OAuth2 token to access the database.

Because applications are “headless” and do not have a user to authenticate interactively with the Azure portal, the interactive flow cannot be used with applications. The client credential flow is designed for applications. In these flows, the application app registration requires a client secret along with the client ID. These are used to retrieve the Entra ID OAuth2 database access token.

After the script gets the token, this token will need to be written to a file (as shown in the examples in this section) so that the database client can access it. Microsoft provides several examples for a service principal to request a token. See then Microsoft article Get Microsoft Entra ID (formerly Azure Active Directory) tokens for service principals.