risingwavelabs/risingwave · error

adlsgen2.authority_host must not contain a query or fragment

Error message

adlsgen2.authority_host must not contain a query or fragment

What it means

adlsgen2.authority_host must be a bare origin: query strings and fragments are rejected because the token endpoint is constructed purely from the origin and path '/', and extra components indicate a malformed or mis-copied URL.

Source

Thrown at src/connector/src/connector_common/iceberg/mod.rs:881

            // echoed into error messages in case a user pasted a secret by mistake.
            if let Some(host) = sp_authority {
                let parsed = Url::parse(host).map_err(|_| {
                    anyhow!(
                        "adlsgen2.authority_host does not parse as a URL ({} chars)",
                        host.len()
                    )
                })?;
                if parsed.scheme() != "https" {
                    bail!(
                        "adlsgen2.authority_host must use the https scheme, got {}",
                        parsed.scheme()
                    );
                }
                if !parsed.username().is_empty() || parsed.password().is_some() {
                    bail!("adlsgen2.authority_host must not contain userinfo");
                }
                if parsed.query().is_some() || parsed.fragment().is_some() {
                    bail!("adlsgen2.authority_host must not contain a query or fragment");
                }
                if !matches!(parsed.path(), "" | "/") {
                    bail!("adlsgen2.authority_host must not contain a path component");
                }
            }

            if let (Some(account_name), Some(account_key)) = (sk_account_name, sk_account_key) {
                iceberg_configs.insert(ADLS_ACCOUNT_NAME.to_owned(), account_name.to_owned());
                iceberg_configs.insert(ADLS_ACCOUNT_KEY.to_owned(), account_key.to_owned());
                require_rest("adlsgen2")?;
            }

            if let (Some(tenant_id), Some(client_id), Some(client_secret)) =
                (sp_tenant, sp_client, sp_secret)
            {
                iceberg_configs.insert(ADLS_TENANT_ID.to_owned(), tenant_id.to_owned());
                iceberg_configs.insert(ADLS_CLIENT_ID.to_owned(), client_id.to_owned());
                iceberg_configs.insert(ADLS_CLIENT_SECRET.to_owned(), client_secret.to_owned());

View on GitHub (pinned to 6469eb736d)

Solutions

1. Strip everything from '?' and '#' onward, keeping only the bare origin (scheme + host + optional '/').
2. Use the canonical AAD host, e.g. https://login.microsoftonline.com/.
3. Remove authority_host to use the built-in default endpoint.

Example fix

// before
'adlsgen2.authority_host' = 'https://login.microsoftonline.com?tenant=abc'
// after
'adlsgen2.authority_host' = 'https://login.microsoftonline.com/'

// strip query/fragment and verify bare origin
function isBareOrigin(v) { try { const u = new URL(v); return u.search === '' && u.hash === ''; } catch { return false; } }

When it happens

Trigger: Setting authority_host to values like 'https://login.microsoftonline.com?tenant=x' or 'https://login.microsoftonline.com#orig'.

Common situations: Copying a full login URL from a browser address bar including ?redirect_uri=... parameters; sharing links with tracking fragments.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• adlsgen2.authority_host does not parse as a URL ({} chars)
• adlsgen2.authority_host must not contain a path component
• adlsgen2: cannot configure both shared-key auth (adlsgen2.ac
• adlsgen2: service-principal auth requires all three of adlsg
• adlsgen2.authority_host must use the https scheme, got {}

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/05d00f8f5bf23388. Report an issue: GitHub.