apache / apache/airflow

Microsoft Azure Connection: Service principal secret does not get masked when providing connection via URI environment variable

Open
#38,144 9 comments 1 reaction 0 assignees View on GitHub
area:providers good first issue kind:bug provider:microsoft-azure
Dominant language
Python
Stars
46.9k
Forks
17.8k
Avg merge
2d 7h
Merged PRs (30d)
484

Description

### Apache Airflow Provider(s)

microsoft-azure

### Versions of Apache Airflow Providers

```
apache-airflow-providers-microsoft-azure==9.0.0
```

### Apache Airflow version

apache-airflow==2.8.1

### Operating System

Ubuntu 22.04.3 LTS

### Deployment

Official Apache Airflow Helm Chart

### Deployment details

_No response_

### What happened

I set the connection as follows:
```
export AIRFLOW_CONN_AZURE_DEFAULT='azure://:?tenantId=&subscriptionId='
```

As `sp-secret` is a password, I would assume it is masked from task logs. However, this is not the case.

I see 2 possible reasons:
- There is no concept of hostname (so no `@fqdn`), which the masking feature might filter on?
- There are special characters in the password field. In my case, the following characters are used: `UPPERCASE, lowercase, ~ - _`

### What you think should happen instead

The log should render:
```
AIRFLOW_CONN_AZURE_DEFAULT=azure://:***?tenantId=&subscriptionId='
```
just like it does with for example postgresql connection.

### How to reproduce

Add the connection (does not even need to make sense) as environment variables:
```
export AIRFLOW_CONN_AZURE_DEFAULT='azure://:?tenantId=&subscriptionId='
```

Create simple DAG to print environment variables

### Anything else

I have tried adding a fake hostname `x` by modifying the string to
```
export AIRFLOW_CONN_AZURE_DEFAULT='azure://:@x?tenantId=&subscriptionId='
```
This still prints the secret unmasked.

### Are you willing to submit PR?

- [ ] Yes I am willing to submit a PR!

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with the documented AIRFLOW_CONN_AZURE_DEFAULT environment variable and a simple DAG that prints environment variables. Trace the connection masking path for the Azure URI, compare it with the stated PostgreSQL behavior, and confirm that the service principal secret is rendered as *** without exposing it in logs.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, python
Domain
cloud, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.