What causes "adlsgen2.authority_host must use the https scheme, got {}" in risingwavelabs/risingwave?

Change the scheme to https:// (e.g. https://login.microsoftonline.com/).

adlsgen2.authority_host must use the https scheme, got {}

Error message

adlsgen2.authority_host must use the https scheme, got {}

What it means

After parsing adlsgen2.authority_host, the connector requires a bare https origin because the OAuth token request carrying the client_secret is sent there. Any non-https scheme (http, ftp, etc.) is rejected.

Source

Thrown at src/connector/src/connector_common/iceberg/mod.rs:872

                    "adlsgen2: service-principal auth requires all three of \
                     adlsgen2.tenant_id, adlsgen2.client_id, and adlsgen2.client_secret \
                     to be set. (adlsgen2.authority_host is optional and defaults to the \
                     public Azure AAD endpoint.)"
                );
            }
            // Defense in depth: reqsign POSTs the OAuth token request — carrying the
            // client_secret to this host. Require a bare https origin: no userinfo,
            // no query, no fragment, and no path beyond "/". The value itself is not
            // echoed into error messages in case a user pasted a secret by mistake.
            if let Some(host) = sp_authority {
                let parsed = Url::parse(host).map_err(|_| {
                    anyhow!(
                        "adlsgen2.authority_host does not parse as a URL ({} chars)",
                        host.len()
                    )
                })?;
                if parsed.scheme() != "https" {
                    bail!(
                        "adlsgen2.authority_host must use the https scheme, got {}",
                        parsed.scheme()
                    );
                }
                if !parsed.username().is_empty() || parsed.password().is_some() {
                    bail!("adlsgen2.authority_host must not contain userinfo");
                }
                if parsed.query().is_some() || parsed.fragment().is_some() {
                    bail!("adlsgen2.authority_host must not contain a query or fragment");
                }
                if !matches!(parsed.path(), "" | "/") {
                    bail!("adlsgen2.authority_host must not contain a path component");
                }
            }

            if let (Some(account_name), Some(account_key)) = (sk_account_name, sk_account_key) {
                iceberg_configs.insert(ADLS_ACCOUNT_NAME.to_owned(), account_name.to_owned());
                iceberg_configs.insert(ADLS_ACCOUNT_KEY.to_owned(), account_key.to_owned());

View on GitHub (pinned to 6469eb736d)

Solutions

Change the scheme to https:// (e.g. https://login.microsoftonline.com/).
Remove authority_host to fall back to the default public Azure AAD https endpoint.
If testing against a non-https IdP, this validation cannot be bypassed by design.

Example fix

-- before
'adlsgen2.authority_host' = 'http://login.microsoftonline.com'
-- after
'adlsgen2.authority_host' = 'https://login.microsoftonline.com'

Defensive patterns

Strategy: validation

Validate before calling

// ensure https scheme before passing authority_host
const schemeOk = (v) => { try { return new URL(v).protocol === 'https:'; } catch { return false; } };

Prevention

Never use http:// for the authority host.
Omit authority_host entirely unless you need a sovereign/regional AAD endpoint.
Check for typos like htps:// or http s:// in hand-edited DDL.

When it happens

Trigger: Setting adlsgen2.authority_host = 'http://login.microsoftonline.com' or any parsed URL whose scheme is not https.

Common situations: Using http for local/testing setups; typos like htps://; copying an internal http-only endpoint.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/54764086ac36c16e. Report an issue: GitHub.