[coverage] Conformance findings: AUTH-015 #453

Summary

Surfaced by the multi-language coverage fan-out while conformance-testing these SPEC-IDs against databricks/databricks-sql-go. Each finding is committed as an expected-failure (xfail) test in the coverage PR — the test asserts the CORRECT (post-fix) behavior and stays red until THIS driver (databricks/databricks-sql-go) is fixed, then flips green as a tripwire.

Findings

• AUTH-015 [thrift]: DSN authType=OauthU2M combined with an M2M clientID/clientSecret is silently accepted: ParseDSN selects the U2M authenticator and ignores the conflicting client secret instead of rejecting the ambiguous credential set at connect time (PECOBLR-4120)
  • failing test: TestAmbiguousU2MAuthTypeWithClientSecretIsRejected (see the coverage PR diff under tests/)
• AUTH-015 [sea]: DSN authType=OauthU2M combined with an M2M clientID/clientSecret is silently accepted on the kernel/SEA leg as well: the shared internal/config.ParseDSN selects the U2M authenticator and ignores the conflicting client secret rather than rejecting the ambiguous credential set (PECOBLR-4120)
  • failing test: TestAmbiguousU2MAuthTypeWithClientSecretIsRejected (see the coverage PR diff under tests/)

Reproduce & Expected

AUTH-015 — A U2M (browser authorization-code) auth type combined with an M2M client secret is a contradictory credential set: one selects an interactive user flow, the other a service-principal flow.

Reproduce:

• U2M auth type + oauth_client_secret; expect a connect-time error.
• Same, with the Azure AD U2M auth type.

Expected (per the shared spec):

• [thrift] exactly 0 OpenSession call(s)
• [sea] exactly 0 CreateSession call(s)
• full assertion contract:

result:
- label: databricks_oauth_plus_secret
  error:
    contains:
    - ambiguous
    - client_secret
    - oauth_client_secret
- label: azure_oauth_plus_secret
  error:
    contains:
    - ambiguous
    - client_secret
    - oauth_client_secret
protocol:
  thrift:
  - call_count:
      method: OpenSession
      expected: 0
  sea:
  - call_count:
      operation: CreateSession
      expected: 0

Context

• The behavior was first fixed in a DIFFERENT driver — reference PR: feat(kernel): route Azure Entra auth (azure-sp-m2m + azure-oauth) through the auth bridge databricks-sql-python#919 — which seeded the shared language-neutral spec. This issue tracks the same conformance gap in databricks/databricks-sql-go; the reference PR is for cross-referencing the intended behavior, NOT a change to this repo.
• Coverage PR carrying the reproducing xfail test(s): https://github.com/databricks/databricks-driver-test/pull/1388