Problem:
The OAC OData v4 connector performs OAuth2 token acquisition from the user's browser (client-side XHR). When using the Client Credentials grant type to
connect to external services such as Microsoft Dynamics 365 / Dataverse, the token endpoint (login.microsoftonline.com) does not return CORS headers,
causing the browser to block the response. This makes it impossible to establish the connection.
The credentials, scope, and endpoint are all valid — the same request succeeds from any server-side client (e.g., Postman, curl, Python).
Current behavior:
- User configures OData connection with OAuth 2.0 Client Credentials.
- OAC sends the token request from the browser (Origin: *.analytics.ocp.oraclecloud.com).
- Microsoft's token endpoint blocks the response due to CORS policy (no Access-Control-Allow-Origin header).
- Connection fails.
This has been confirmed via browser DevTools network trace. Oracle Support (SR filed June 2026) acknowledged that "no configurable backend token
acquisition option is currently documented for this connector."
Requested enhancement:
Implement server-side (backend) OAuth2 token acquisition in the OData connector for the Client Credentials flow. The token exchange should happen on the
OAC server, not in the user's browser. This is the standard pattern for confidential-client OAuth2 flows.
Business impact:
This limitation prevents OAC from connecting to any external OData source that requires OAuth2 Client Credentials and does not support CORS on its token
endpoint — which includes Microsoft Dynamics 365, one of the most widely used CRM/ERP platforms. Customers needing CRM data in their analytics are forced
into custom ETL workarounds.
Workaround (current):
None within OAC. The only alternatives are building a proxy (OCI API Gateway + Function) or an ETL pipeline to replicate data into Oracle DB, both of
which add cost and complexity.
