{"record":{"id":"7f5c79a2940ee41a","repo":"risingwavelabs/risingwave","slug":"adlsgen2-authority-host-must-not-contain-a-path-co","errorCode":null,"errorMessage":"adlsgen2.authority_host must not contain a path component","messagePattern":"adlsgen2\\.authority_host must not contain a path component","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/connector/src/connector_common/iceberg/mod.rs","lineNumber":884,"sourceCode":"                    anyhow!(\n                        \"adlsgen2.authority_host does not parse as a URL ({} chars)\",\n                        host.len()\n                    )\n                })?;\n                if parsed.scheme() != \"https\" {\n                    bail!(\n                        \"adlsgen2.authority_host must use the https scheme, got {}\",\n                        parsed.scheme()\n                    );\n                }\n                if !parsed.username().is_empty() || parsed.password().is_some() {\n                    bail!(\"adlsgen2.authority_host must not contain userinfo\");\n                }\n                if parsed.query().is_some() || parsed.fragment().is_some() {\n                    bail!(\"adlsgen2.authority_host must not contain a query or fragment\");\n                }\n                if !matches!(parsed.path(), \"\" | \"/\") {\n                    bail!(\"adlsgen2.authority_host must not contain a path component\");\n                }\n            }\n\n            if let (Some(account_name), Some(account_key)) = (sk_account_name, sk_account_key) {\n                iceberg_configs.insert(ADLS_ACCOUNT_NAME.to_owned(), account_name.to_owned());\n                iceberg_configs.insert(ADLS_ACCOUNT_KEY.to_owned(), account_key.to_owned());\n                require_rest(\"adlsgen2\")?;\n            }\n\n            if let (Some(tenant_id), Some(client_id), Some(client_secret)) =\n                (sp_tenant, sp_client, sp_secret)\n            {\n                iceberg_configs.insert(ADLS_TENANT_ID.to_owned(), tenant_id.to_owned());\n                iceberg_configs.insert(ADLS_CLIENT_ID.to_owned(), client_id.to_owned());\n                iceberg_configs.insert(ADLS_CLIENT_SECRET.to_owned(), client_secret.to_owned());\n                // Strip trailing slash to prevent double slash\n                let authority_host = sp_authority\n                    .unwrap_or(ADLS_DEFAULT_AUTHORITY_HOST)","sourceCodeStart":866,"sourceCodeEnd":902,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/connector_common/iceberg/mod.rs#L866-L902","documentation":"adlsgen2.authority_host must not include a path component (only '' or '/' is allowed). The OAuth token URL is built from the bare origin, so any deeper path would either be ignored or produce a wrong token endpoint; the connector rejects it outright.","triggerScenarios":"Setting authority_host to 'https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token' or any origin plus path.","commonSituations":"Copying the full token endpoint URL instead of just the host; specifying the tenant path believing it is required (it belongs in tenant_id instead).","solutions":["Reduce the value to just the origin, e.g. https://login.microsoftonline.com/.","Move the tenant identifier into adlsgen2.tenant_id, not the authority_host path.","Remove authority_host to use the default public Azure AAD endpoint."],"exampleFix":"// before\n'adlsgen2.authority_host' = 'https://login.microsoftonline.com/mytenant/oauth2/v2.0/token'\n// after\n'adlsgen2.authority_host' = 'https://login.microsoftonline.com/'","handlingStrategy":"validation","validationCode":"// authority_host must be scheme + host (+ optional single '/')\nfunction isOriginOnly(v) { try { const u = new URL(v); return (u.pathname === '/' || u.pathname === '') && u.search === '' && u.hash === ''; } catch { return false; } }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the AAD host root, not the token endpoint URL.","Put tenant identification in adlsgen2.tenant_id, never in the path.","Remove authority_host to rely on the default endpoint when unsure."],"tags":["iceberg","adlsgen2","url","configuration"],"backgroundTag":"invalid-url-format","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}