Deprecate the params field of _obtain_token

msal/oauth2cli/oauth2.py

@@ -184,14 +184,25 @@ def _build_auth_request_params(self, response_type, **kwargs):
 
     def _obtain_token(  # The verb "obtain" is influenced by OAUTH2 RFC 6749
             self, grant_type,
-            params=None,  # a dict to be sent as query string to the endpoint
             data=None,  # All relevant data, which will go into the http body
             headers=None,  # a dict to be sent as request headers
             post=None,  # A callable to replace requests.post(), for testing.
                         # Such as: lambda url, **kwargs:
                         #   Mock(status_code=200, text='{}')
             **kwargs  # Relay all extra parameters to underlying requests
             ):  # Returns the json object came from the OAUTH2 response
+
+        # Handle deprecated params parameter
+        params = kwargs.pop('params', None)
+        if params is not None:
+            import warnings
+            warnings.warn(
+                "Setting 'params' is recommended for production scenarios. "
+                "It will be removed in a future release, and the behavior may be replaced by a new API.",
+                FutureWarning,
+                stacklevel=2
+            )
+
         _data = {'client_id': self.client_id, 'grant_type': grant_type}
 
         if self.default_body.get("client_assertion_type") and self.client_assertion:
@@ -771,13 +782,18 @@ def __init__(self,
         self.on_updating_rt = on_updating_rt
 
     def _obtain_token(
-            self, grant_type, params=None, data=None,
+            self, grant_type, data=None,
             also_save_rt=False,
             on_obtaining_tokens=None,
             *args, **kwargs):
         _data = data.copy()  # to prevent side effect
+
+        # Handle deprecated params parameter. It was removed as an argument here and in BaseClient._obtain_token(),
+        # and BaseClient._obtain_token() provides the deprecation warning if params is used.
+        params = kwargs.pop('params', None)
+
         resp = super(Client, self)._obtain_token(
-            grant_type, params, _data, *args, **kwargs)
+            grant_type, _data, *args, **kwargs)
         if "error" not in resp:
             _resp = resp.copy()
             RT = "refresh_token"