risingwavelabs/risingwave · error

adlsgen2.authority_host must not contain userinfo

Error message

adlsgen2.authority_host must not contain userinfo

What it means

As defense in depth, adlsgen2.authority_host must be a bare https origin: the connector rejects URLs containing userinfo (username or password) since the OAuth token request to this host carries the client_secret.

Source

Thrown at src/connector/src/connector_common/iceberg/mod.rs:878

            // Defense in depth: reqsign POSTs the OAuth token request — carrying the
            // client_secret to this host. Require a bare https origin: no userinfo,
            // no query, no fragment, and no path beyond "/". The value itself is not
            // echoed into error messages in case a user pasted a secret by mistake.
            if let Some(host) = sp_authority {
                let parsed = Url::parse(host).map_err(|_| {
                    anyhow!(
                        "adlsgen2.authority_host does not parse as a URL ({} chars)",
                        host.len()
                    )
                })?;
                if parsed.scheme() != "https" {
                    bail!(
                        "adlsgen2.authority_host must use the https scheme, got {}",
                        parsed.scheme()
                    );
                }
                if !parsed.username().is_empty() || parsed.password().is_some() {
                    bail!("adlsgen2.authority_host must not contain userinfo");
                }
                if parsed.query().is_some() || parsed.fragment().is_some() {
                    bail!("adlsgen2.authority_host must not contain a query or fragment");
                }
                if !matches!(parsed.path(), "" | "/") {
                    bail!("adlsgen2.authority_host must not contain a path component");
                }
            }

            if let (Some(account_name), Some(account_key)) = (sk_account_name, sk_account_key) {
                iceberg_configs.insert(ADLS_ACCOUNT_NAME.to_owned(), account_name.to_owned());
                iceberg_configs.insert(ADLS_ACCOUNT_KEY.to_owned(), account_key.to_owned());
                require_rest("adlsgen2")?;
            }

            if let (Some(tenant_id), Some(client_id), Some(client_secret)) =
                (sp_tenant, sp_client, sp_secret)
            {

View on GitHub (pinned to 6469eb736d)

Solutions

1. Remove the user:password@ portion from the URL, keeping only scheme + host.
2. Pass credentials only via adlsgen2.client_id and adlsgen2.client_secret.
3. Verify the value resolves to a bare origin like https://login.microsoftonline.com/

Example fix

// before
'adlsgen2.authority_host' = 'https://user:pass@login.microsoftonline.com'
// after
'adlsgen2.authority_host' = 'https://login.microsoftonline.com'

// reject userinfo before submitting
function hasNoUserinfo(v) { try { const u = new URL(v); return u.username === '' && u.password === ''; } catch { return false; } }

When it happens

Trigger: Setting authority_host like 'https://user:pass@login.microsoftonline.com' or 'https://someone@host' — parsed.username() non-empty or parsed.password() present.

Common situations: Pasting a full credential-bearing URL copied from a browser; mistaking authority_host for a credential field; template placeholders left in like https://{user}@....

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• adlsgen2.authority_host must use the https scheme, got {}
• adlsgen2.authority_host does not parse as a URL ({} chars)
• adlsgen2.authority_host must not contain a query or fragment
• adlsgen2.authority_host must not contain a path component
• `enable_config_load` can't be enabled in this environment

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/553ee64bb33b4f8d. Report an issue: GitHub.