[coverage] Conformance findings: AUTH-015 #926

Summary

Surfaced by the multi-language coverage fan-out while conformance-testing these SPEC-IDs against databricks/databricks-sql-python. Each finding is committed as an expected-failure (xfail) test in the coverage PR — the test asserts the CORRECT (post-fix) behavior and stays red until THIS driver (databricks/databricks-sql-python) is fixed, then flips green as a tripwire.

Findings

• AUTH-015 [thrift]: Thrift path ignores oauth_client_secret when auth_type is a U2M type (databricks-oauth / azure-oauth) and starts the interactive U2M browser flow instead of rejecting the ambiguous U2M+M2M credential set; the guard exists only in the kernel auth bridge (PECOBLR-4120)
  • failing test: test_ambiguous_u2m_auth_type_with_client_secret_is_rejected (see the coverage PR diff under tests/)

Reproduce & Expected

AUTH-015 — A U2M (browser authorization-code) auth type combined with an M2M client secret is a contradictory credential set: one selects an interactive user flow, the other a service-principal flow.

Reproduce:

• U2M auth type + oauth_client_secret; expect a connect-time error.
• Same, with the Azure AD U2M auth type.

Expected (per the shared spec):

• [thrift] exactly 0 OpenSession call(s)
• [sea] exactly 0 CreateSession call(s)
• full assertion contract:

result:
- label: databricks_oauth_plus_secret
  error:
    contains:
    - ambiguous
    - client_secret
    - oauth_client_secret
- label: azure_oauth_plus_secret
  error:
    contains:
    - ambiguous
    - client_secret
    - oauth_client_secret
protocol:
  thrift:
  - call_count:
      method: OpenSession
      expected: 0
  sea:
  - call_count:
      operation: CreateSession
      expected: 0

Context

• The behavior was first fixed in a DIFFERENT driver — reference PR: feat(kernel): route Azure Entra auth (azure-sp-m2m + azure-oauth) through the auth bridge #919 — which seeded the shared language-neutral spec. This issue tracks the same conformance gap in databricks/databricks-sql-python; the reference PR is for cross-referencing the intended behavior, NOT a change to this repo.
• Coverage PR carrying the reproducing xfail test(s): https://github.com/databricks/databricks-driver-test/pull/1388