adlsgen2: service-principal auth requires all three of adlsg

Error message

adlsgen2: service-principal auth requires all three of adlsgen2.tenant_id, adlsgen2.client_id, and adlsgen2.client_secret to be set. (adlsgen2.authority_host is optional and defaults to the public Azure AAD endpoint.)

What it means

When any service-principal auth field is provided for an adlsgen2 Iceberg connection, all three of tenant_id, client_id and client_secret are mandatory; authority_host is optional. The connector bails out if only a partial subset is given, because OAuth client-credential flow cannot proceed without the full triple.

Source

Thrown at src/connector/src/connector_common/iceberg/mod.rs:853

            let sp_authority = nonempty(&self.adlsgen2_authority_host);
            let sk_account_name = nonempty(&self.adlsgen2_account_name);
            let sk_account_key = nonempty(&self.adlsgen2_account_key);
            let any_sp_field = sp_tenant.is_some()
                || sp_client.is_some()
                || sp_secret.is_some()
                || sp_authority.is_some();
            let all_sp_required = sp_tenant.is_some() && sp_client.is_some() && sp_secret.is_some();

            if sk_account_key.is_some() && any_sp_field {
                bail!(
                    "adlsgen2: cannot configure both shared-key auth \
                     (adlsgen2.account_key) and service-principal auth \
                     (adlsgen2.tenant_id / adlsgen2.client_id / adlsgen2.client_secret / \
                     adlsgen2.authority_host) simultaneously. Specify exactly one auth mode."
                );
            }
            if any_sp_field && !all_sp_required {
                bail!(
                    "adlsgen2: service-principal auth requires all three of \
                     adlsgen2.tenant_id, adlsgen2.client_id, and adlsgen2.client_secret \
                     to be set. (adlsgen2.authority_host is optional and defaults to the \
                     public Azure AAD endpoint.)"
                );
            }
            // Defense in depth: reqsign POSTs the OAuth token request — carrying the
            // client_secret to this host. Require a bare https origin: no userinfo,
            // no query, no fragment, and no path beyond "/". The value itself is not
            // echoed into error messages in case a user pasted a secret by mistake.
            if let Some(host) = sp_authority {
                let parsed = Url::parse(host).map_err(|_| {
                    anyhow!(
                        "adlsgen2.authority_host does not parse as a URL ({} chars)",
                        host.len()
                    )
                })?;
                if parsed.scheme() != "https" {

View on GitHub (pinned to 6469eb736d)

Solutions

Add the missing adlsgen2.tenant_id, adlsgen2.client_id, or adlsgen2.client_secret field(s).
If you meant shared-key auth instead, remove all SP fields and set adlsgen2.account_key (plus account name).
Optionally set adlsgen2.authority_host for sovereign clouds; it is not required.

Example fix

-- before
WITH (
  'adlsgen2.tenant_id' = 't',
  'adlsgen2.client_id' = 'c'
)
-- after
WITH (
  'adlsgen2.tenant_id' = 't',
  'adlsgen2.client_id' = 'c',
  'adlsgen2.client_secret' = 's'
)

Defensive patterns

Strategy: validation

Validate before calling

-- before submitting DDL, check the SP triple is complete:
-- tenant_id, client_id and client_secret must all be present
SELECT (tenant_id IS NOT NULL AND client_id IS NOT NULL AND client_secret IS NOT NULL) AS sp_complete;

Prevention

Store the SP triple as one unit (secret manager entry, env group) so fields never split.
List all four SP keys in your DDL checklist; authority_host optional.
Avoid manually redacting DDL — regenerate from a template.

When it happens

Trigger: Setting, e.g., only adlsgen2.client_id (or tenant_id + client_id without client_secret) while account_key is absent, so the connector detects SP mode but incomplete credentials.

Common situations: Redacting one secret when sharing DDL; forgetting client_secret; assuming tenant_id is optional; field named differently in the Azure portal than in with-props.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/b6f8bf68adc52319. Report an issue: GitHub.