You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|`oauth_client_id` (U2M) |`str`| ✅ | ✅ | built-in client id | Custom U2M client id. Forwarded on both; when absent, each path applies its own built-in default. |
73
-
|`oauth_redirect_port` (U2M) |`int`| ✅ | ✅ |`None`| Localhost redirect port for the browser flow; required when a custom `oauth_client_id` is set. |
74
+
|`oauth_redirect_port` (U2M) |`int`| ✅ | ✅ |`None`| Localhost redirect port for the browser flow; optional — defaults to the built-in port range 8020–8024 if omitted (even when a custom `oauth_client_id` is set).|
74
75
|`oauth_client_secret` (OAuth M2M) |`str`| ❌ | ✅ |`None`|**Kernel-only in practice.** The Thrift auth path never reads `oauth_client_secret`; use `credentials_provider` or an Azure service principal for M2M on Thrift. |
75
76
|`oauth_scopes`|`List[str]`| ❌ | ✅ |`["sql","offline_access"]`|**Thrift ignores custom scopes** — it always uses the built-in scope set. Only the kernel honors a custom `oauth_scopes`. |
76
77
|`credentials_provider`|`CredentialsProvider`| ✅ | ❌ |`None`| Custom external credentials provider. **Rejected on the kernel path** (`NotSupportedError`) — it is an opaque token source, so the kernel cannot own the token lifecycle; use `oauth_client_id` + `oauth_client_secret` for M2M, or the Thrift backend. |
@@ -82,6 +83,14 @@ to change without notice.
82
83
83
84
## HTTP client, proxy, retries
84
85
86
+
> **Retry defaults are Thrift defaults.** The **Default Value** column lists the
87
+
> values the *Thrift* backend applies. For the ✅-Kernel retry rows
0 commit comments