TENANT_ID in TNS connection string is ignored during Entra ID interactive authentication — always uses /organizations/ endpoint

[mreinli]

Environment

Oracle SQL Developer Extension for VS Code: 26.2.0
VS Code version: 1.125.1
OS: macOS (Apple Silicon)
Target database: Autonomous Database (ADB-D, TCPS connection with mTLS)
Authentication method: TOKEN_AUTH=AZURE_INTERACTIVE

Configuration

TNS entry used for the connection:
INTERACTIVE = (DESCRIPTION = (CONNECT_TIMEOUT = 90) (RETRY_COUNT = 50) (RETRY_DELAY = 3) (TRANSPORT_CONNECT_TIMEOUT = 3) (ADDRESS_LIST = (LOAD_BALANCE = ON) (ADDRESS = (PROTOCOL = TCPS)(HOST = <scan-host-1>)(PORT = 2484)) (ADDRESS = (PROTOCOL = TCPS)(HOST = <scan-host-2>)(PORT = 2484)) ) (CONNECT_DATA = (SERVICE_NAME = <service_name>) ) (SECURITY = (SSL_SERVER_DN_MATCH=TRUE) (WALLET_LOCATION=<wallet_path>) (TOKEN_AUTH=AZURE_INTERACTIVE) (TENANT_ID=<my-guest-tenant-guid>) (CLIENT_ID=<client-app-id>) (AZURE_DB_APP_ID_URI=https://<tenant-domain>.onmicrosoft.com/<db-app-id>) ) )

The user account authenticating is a guest account (Entra ID B2B) in the tenant specified by TENANT_ID (i.e. not the user's home tenant).

Expected behavior

When opening the connection, the extension should launch an interactive browser authentication request scoped to the tenant specified in TENANT_ID, i.e. the generated authorize URL should look like:
https://login.microsoftonline.com/<my-guest-tenant-guid>/oauth2/v2.0/authorize?...

Observed behavior

The extension instead generates an authorize URL using the generic /organizations/ endpoint, ignoring the TENANT_ID value entirely:
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?scope=openid+profile+offline_access+https%3A%2F%2F...%2F.default&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A<port>&code_challenge_method=S256&state=...&prompt=select_account&code_challenge=...&client_id=<client-app-id>&response_mode=form_post

Because the account is a guest in the target tenant, prompt=select_account against /organizations/ resolves to the user's home tenant by default, and authentication against the intended (guest) tenant fails / requires manually picking the correct account, which is not always reliably possible from the account picker.

Workaround found

Manually editing the generated URL — replacing /organizations/ with the actual tenant GUID from TENANT_ID — and opening it directly in the browser results in a successful authentication and connection. This confirms:

• The app registration, consent, scope, and redirect URI configuration are all correct
• The issue is isolated to the extension/driver not propagating TENANT_ID into the generated authorization request URL

Steps to reproduce

1. Configure a TNS entry with TOKEN_AUTH=AZURE_INTERACTIVE and an explicit TENANT_ID pointing to a tenant where the authenticating user is a guest, not a member
2. Open the connection in the SQL Developer extension
3. Observe the browser navigates to https://login.microsoftonline.com/organizations/... instead of https://login.microsoftonline.com/<TENANT_ID>/...

Additional notes

This may be specific to guest-account scenarios, since the home tenant may be silently preferred by the account picker when the tenant-scoped endpoint isn't used. Happy to provide additional logs/HAR captures if useful.