risingwavelabs/risingwave · error

adlsgen2.authority_host must not contain a path component

Error message

adlsgen2.authority_host must not contain a path component

What it means

adlsgen2.authority_host must not include a path component (only '' or '/' is allowed). The OAuth token URL is built from the bare origin, so any deeper path would either be ignored or produce a wrong token endpoint; the connector rejects it outright.

Source

Thrown at src/connector/src/connector_common/iceberg/mod.rs:884

                    anyhow!(
                        "adlsgen2.authority_host does not parse as a URL ({} chars)",
                        host.len()
                    )
                })?;
                if parsed.scheme() != "https" {
                    bail!(
                        "adlsgen2.authority_host must use the https scheme, got {}",
                        parsed.scheme()
                    );
                }
                if !parsed.username().is_empty() || parsed.password().is_some() {
                    bail!("adlsgen2.authority_host must not contain userinfo");
                }
                if parsed.query().is_some() || parsed.fragment().is_some() {
                    bail!("adlsgen2.authority_host must not contain a query or fragment");
                }
                if !matches!(parsed.path(), "" | "/") {
                    bail!("adlsgen2.authority_host must not contain a path component");
                }
            }

            if let (Some(account_name), Some(account_key)) = (sk_account_name, sk_account_key) {
                iceberg_configs.insert(ADLS_ACCOUNT_NAME.to_owned(), account_name.to_owned());
                iceberg_configs.insert(ADLS_ACCOUNT_KEY.to_owned(), account_key.to_owned());
                require_rest("adlsgen2")?;
            }

            if let (Some(tenant_id), Some(client_id), Some(client_secret)) =
                (sp_tenant, sp_client, sp_secret)
            {
                iceberg_configs.insert(ADLS_TENANT_ID.to_owned(), tenant_id.to_owned());
                iceberg_configs.insert(ADLS_CLIENT_ID.to_owned(), client_id.to_owned());
                iceberg_configs.insert(ADLS_CLIENT_SECRET.to_owned(), client_secret.to_owned());
                // Strip trailing slash to prevent double slash
                let authority_host = sp_authority
                    .unwrap_or(ADLS_DEFAULT_AUTHORITY_HOST)

View on GitHub (pinned to 6469eb736d)

Solutions

1. Reduce the value to just the origin, e.g. https://login.microsoftonline.com/.
2. Move the tenant identifier into adlsgen2.tenant_id, not the authority_host path.
3. Remove authority_host to use the default public Azure AAD endpoint.

Example fix

// before
'adlsgen2.authority_host' = 'https://login.microsoftonline.com/mytenant/oauth2/v2.0/token'
// after
'adlsgen2.authority_host' = 'https://login.microsoftonline.com/'

// authority_host must be scheme + host (+ optional single '/')
function isOriginOnly(v) { try { const u = new URL(v); return (u.pathname === '/' || u.pathname === '') && u.search === '' && u.hash === ''; } catch { return false; } }

When it happens

Trigger: Setting authority_host to 'https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token' or any origin plus path.

Common situations: Copying the full token endpoint URL instead of just the host; specifying the tenant path believing it is required (it belongs in tenant_id instead).

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• adlsgen2.authority_host does not parse as a URL ({} chars)
• adlsgen2.authority_host must not contain a query or fragment
• adlsgen2: cannot configure both shared-key auth (adlsgen2.ac
• adlsgen2: service-principal auth requires all three of adlsg
• adlsgen2.authority_host must use the https scheme, got {}

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/7f5c79a2940ee41a. Report an issue: GitHub.