{"record":{"id":"54764086ac36c16e","repo":"risingwavelabs/risingwave","slug":"adlsgen2-authority-host-must-use-the-https-scheme","errorCode":null,"errorMessage":"adlsgen2.authority_host must use the https scheme, got {}","messagePattern":"adlsgen2\\.authority_host must use the https scheme, got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/connector/src/connector_common/iceberg/mod.rs","lineNumber":872,"sourceCode":"                    \"adlsgen2: service-principal auth requires all three of \\\n                     adlsgen2.tenant_id, adlsgen2.client_id, and adlsgen2.client_secret \\\n                     to be set. (adlsgen2.authority_host is optional and defaults to the \\\n                     public Azure AAD endpoint.)\"\n                );\n            }\n            // Defense in depth: reqsign POSTs the OAuth token request — carrying the\n            // client_secret to this host. Require a bare https origin: no userinfo,\n            // no query, no fragment, and no path beyond \"/\". The value itself is not\n            // echoed into error messages in case a user pasted a secret by mistake.\n            if let Some(host) = sp_authority {\n                let parsed = Url::parse(host).map_err(|_| {\n                    anyhow!(\n                        \"adlsgen2.authority_host does not parse as a URL ({} chars)\",\n                        host.len()\n                    )\n                })?;\n                if parsed.scheme() != \"https\" {\n                    bail!(\n                        \"adlsgen2.authority_host must use the https scheme, got {}\",\n                        parsed.scheme()\n                    );\n                }\n                if !parsed.username().is_empty() || parsed.password().is_some() {\n                    bail!(\"adlsgen2.authority_host must not contain userinfo\");\n                }\n                if parsed.query().is_some() || parsed.fragment().is_some() {\n                    bail!(\"adlsgen2.authority_host must not contain a query or fragment\");\n                }\n                if !matches!(parsed.path(), \"\" | \"/\") {\n                    bail!(\"adlsgen2.authority_host must not contain a path component\");\n                }\n            }\n\n            if let (Some(account_name), Some(account_key)) = (sk_account_name, sk_account_key) {\n                iceberg_configs.insert(ADLS_ACCOUNT_NAME.to_owned(), account_name.to_owned());\n                iceberg_configs.insert(ADLS_ACCOUNT_KEY.to_owned(), account_key.to_owned());","sourceCodeStart":854,"sourceCodeEnd":890,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/connector_common/iceberg/mod.rs#L854-L890","documentation":"After parsing adlsgen2.authority_host, the connector requires a bare https origin because the OAuth token request carrying the client_secret is sent there. Any non-https scheme (http, ftp, etc.) is rejected.","triggerScenarios":"Setting adlsgen2.authority_host = 'http://login.microsoftonline.com' or any parsed URL whose scheme is not https.","commonSituations":"Using http for local/testing setups; typos like htps://; copying an internal http-only endpoint.","solutions":["Change the scheme to https:// (e.g. https://login.microsoftonline.com/).","Remove authority_host to fall back to the default public Azure AAD https endpoint.","If testing against a non-https IdP, this validation cannot be bypassed by design."],"exampleFix":"-- before\n'adlsgen2.authority_host' = 'http://login.microsoftonline.com'\n-- after\n'adlsgen2.authority_host' = 'https://login.microsoftonline.com'","handlingStrategy":"validation","validationCode":"// ensure https scheme before passing authority_host\nconst schemeOk = (v) => { try { return new URL(v).protocol === 'https:'; } catch { return false; } };","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never use http:// for the authority host.","Omit authority_host entirely unless you need a sovereign/regional AAD endpoint.","Check for typos like htps:// or http s:// in hand-edited DDL."],"tags":["iceberg","adlsgen2","security","url"],"backgroundTag":"invalid-config-value","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}