Microsoft Azure Connection: Service principal secret does not get masked when providing connection via URI environment variable
- Dominant language
- Python
- Stars
- 46.9k
- Forks
- 17.8k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 484
Description
### Apache Airflow Provider(s)
microsoft-azure
### Versions of Apache Airflow Providers
```
apache-airflow-providers-microsoft-azure==9.0.0
```
### Apache Airflow version
apache-airflow==2.8.1
### Operating System
Ubuntu 22.04.3 LTS
### Deployment
Official Apache Airflow Helm Chart
### Deployment details
_No response_
### What happened
I set the connection as follows:
```
export AIRFLOW_CONN_AZURE_DEFAULT='azure://:?tenantId=&subscriptionId='
```
As `sp-secret` is a password, I would assume it is masked from task logs. However, this is not the case.
I see 2 possible reasons:
- There is no concept of hostname (so no `@fqdn`), which the masking feature might filter on?
- There are special characters in the password field. In my case, the following characters are used: `UPPERCASE, lowercase, ~ - _`
### What you think should happen instead
The log should render:
```
AIRFLOW_CONN_AZURE_DEFAULT=azure://:***?tenantId=&subscriptionId='
```
just like it does with for example postgresql connection.
### How to reproduce
Add the connection (does not even need to make sense) as environment variables:
```
export AIRFLOW_CONN_AZURE_DEFAULT='azure://:?tenantId=&subscriptionId='
```
Create simple DAG to print environment variables
### Anything else
I have tried adding a fake hostname `x` by modifying the string to
```
export AIRFLOW_CONN_AZURE_DEFAULT='azure://:@x?tenantId=&subscriptionId='
```
This still prints the secret unmasked.
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
Contributor guide
Research direction
Reproduce the issue with the documented AIRFLOW_CONN_AZURE_DEFAULT environment variable and a simple DAG that prints environment variables. Trace the connection masking path for the Azure URI, compare it with the stated PostgreSQL behavior, and confirm that the service principal secret is rendered as *** without exposing it in logs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, python
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100