What causes "adlsgen2.authority_host does not parse as a URL ({} chars)" in risingwavelabs/risingwave?

Provide a full absolute URL, e.g. 'https://login.microsoftonline.com/'.

adlsgen2.authority_host does not parse as a URL ({} chars)

Error message

adlsgen2.authority_host does not parse as a URL ({} chars)

What it means

The optional adlsgen2.authority_host value must be a valid URL because reqsign will POST the OAuth token request (carrying the client_secret) to it. If Url::parse fails, the connector throws this error. It deliberately reports only the character count, never the value itself, in case a user pasted a secret by mistake.

Source

Thrown at src/connector/src/connector_common/iceberg/mod.rs:866

                     (adlsgen2.tenant_id / adlsgen2.client_id / adlsgen2.client_secret / \
                     adlsgen2.authority_host) simultaneously. Specify exactly one auth mode."
                );
            }
            if any_sp_field && !all_sp_required {
                bail!(
                    "adlsgen2: service-principal auth requires all three of \
                     adlsgen2.tenant_id, adlsgen2.client_id, and adlsgen2.client_secret \
                     to be set. (adlsgen2.authority_host is optional and defaults to the \
                     public Azure AAD endpoint.)"
                );
            }
            // Defense in depth: reqsign POSTs the OAuth token request — carrying the
            // client_secret to this host. Require a bare https origin: no userinfo,
            // no query, no fragment, and no path beyond "/". The value itself is not
            // echoed into error messages in case a user pasted a secret by mistake.
            if let Some(host) = sp_authority {
                let parsed = Url::parse(host).map_err(|_| {
                    anyhow!(
                        "adlsgen2.authority_host does not parse as a URL ({} chars)",
                        host.len()
                    )
                })?;
                if parsed.scheme() != "https" {
                    bail!(
                        "adlsgen2.authority_host must use the https scheme, got {}",
                        parsed.scheme()
                    );
                }
                if !parsed.username().is_empty() || parsed.password().is_some() {
                    bail!("adlsgen2.authority_host must not contain userinfo");
                }
                if parsed.query().is_some() || parsed.fragment().is_some() {
                    bail!("adlsgen2.authority_host must not contain a query or fragment");
                }
                if !matches!(parsed.path(), "" | "/") {
                    bail!("adlsgen2.authority_host must not contain a path component");

View on GitHub (pinned to 6469eb736d)

Solutions

Provide a full absolute URL, e.g. 'https://login.microsoftonline.com/'.
Check for stray whitespace or quotes around the value in the DDL.
Remove adlsgen2.authority_host entirely to use the default public Azure AAD endpoint.

Example fix

-- before
'adlsgen2.authority_host' = 'login.microsoftonline.com'
-- after
'adlsgen2.authority_host' = 'https://login.microsoftonline.com/'

Defensive patterns

Strategy: validation

Validate before calling

// JS pre-check before building the DDL
function isValidAuthorityHost(v) {
  try { const u = new URL(v); return u.protocol === 'https:' && !!u.hostname; }
  catch { return false; }
}
isValidAuthorityHost('https://login.microsoftonline.com/'); // true

Prevention

Always include the https:// scheme in authority_host.
Use canonical values: https://login.microsoftonline.com/ or your sovereign-cloud AAD host.
Never paste secrets into authority_host — errors only show the char count.

When it happens

Trigger: Setting adlsgen2.authority_host to a malformed value such as 'login.microsoftonline.com' (missing scheme), 'https://' (empty host), or a value with stray spaces/quotes.

Common situations: Omitting the https:// prefix; copying an authority host with surrounding whitespace from docs; accidentally pasting the client secret into authority_host.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/17f7d006a917a37e. Report an issue: GitHub.