{"record":{"id":"17f7d006a917a37e","repo":"risingwavelabs/risingwave","slug":"adlsgen2-authority-host-does-not-parse-as-a-url","errorCode":null,"errorMessage":"adlsgen2.authority_host does not parse as a URL ({} chars)","messagePattern":"adlsgen2\\.authority_host does not parse as a URL \\((.+?) chars\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/connector/src/connector_common/iceberg/mod.rs","lineNumber":866,"sourceCode":"                     (adlsgen2.tenant_id / adlsgen2.client_id / adlsgen2.client_secret / \\\n                     adlsgen2.authority_host) simultaneously. Specify exactly one auth mode.\"\n                );\n            }\n            if any_sp_field && !all_sp_required {\n                bail!(\n                    \"adlsgen2: service-principal auth requires all three of \\\n                     adlsgen2.tenant_id, adlsgen2.client_id, and adlsgen2.client_secret \\\n                     to be set. (adlsgen2.authority_host is optional and defaults to the \\\n                     public Azure AAD endpoint.)\"\n                );\n            }\n            // Defense in depth: reqsign POSTs the OAuth token request — carrying the\n            // client_secret to this host. Require a bare https origin: no userinfo,\n            // no query, no fragment, and no path beyond \"/\". The value itself is not\n            // echoed into error messages in case a user pasted a secret by mistake.\n            if let Some(host) = sp_authority {\n                let parsed = Url::parse(host).map_err(|_| {\n                    anyhow!(\n                        \"adlsgen2.authority_host does not parse as a URL ({} chars)\",\n                        host.len()\n                    )\n                })?;\n                if parsed.scheme() != \"https\" {\n                    bail!(\n                        \"adlsgen2.authority_host must use the https scheme, got {}\",\n                        parsed.scheme()\n                    );\n                }\n                if !parsed.username().is_empty() || parsed.password().is_some() {\n                    bail!(\"adlsgen2.authority_host must not contain userinfo\");\n                }\n                if parsed.query().is_some() || parsed.fragment().is_some() {\n                    bail!(\"adlsgen2.authority_host must not contain a query or fragment\");\n                }\n                if !matches!(parsed.path(), \"\" | \"/\") {\n                    bail!(\"adlsgen2.authority_host must not contain a path component\");","sourceCodeStart":848,"sourceCodeEnd":884,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/connector_common/iceberg/mod.rs#L848-L884","documentation":"The optional adlsgen2.authority_host value must be a valid URL because reqsign will POST the OAuth token request (carrying the client_secret) to it. If Url::parse fails, the connector throws this error. It deliberately reports only the character count, never the value itself, in case a user pasted a secret by mistake.","triggerScenarios":"Setting adlsgen2.authority_host to a malformed value such as 'login.microsoftonline.com' (missing scheme), 'https://' (empty host), or a value with stray spaces/quotes.","commonSituations":"Omitting the https:// prefix; copying an authority host with surrounding whitespace from docs; accidentally pasting the client secret into authority_host.","solutions":["Provide a full absolute URL, e.g. 'https://login.microsoftonline.com/'.","Check for stray whitespace or quotes around the value in the DDL.","Remove adlsgen2.authority_host entirely to use the default public Azure AAD endpoint."],"exampleFix":"-- before\n'adlsgen2.authority_host' = 'login.microsoftonline.com'\n-- after\n'adlsgen2.authority_host' = 'https://login.microsoftonline.com/'","handlingStrategy":"validation","validationCode":"// JS pre-check before building the DDL\nfunction isValidAuthorityHost(v) {\n  try { const u = new URL(v); return u.protocol === 'https:' && !!u.hostname; }\n  catch { return false; }\n}\nisValidAuthorityHost('https://login.microsoftonline.com/'); // true","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always include the https:// scheme in authority_host.","Use canonical values: https://login.microsoftonline.com/ or your sovereign-cloud AAD host.","Never paste secrets into authority_host — errors only show the char count."],"tags":["iceberg","adlsgen2","url","configuration"],"backgroundTag":"invalid-url-format","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}