Microsoft Azure Connection: Service principal secret does not get masked when providing connection via URI environment variable

Apache Airflow Provider(s)

microsoft-azure

Versions of Apache Airflow Providers

apache-airflow-providers-microsoft-azure==9.0.0

Apache Airflow version

apache-airflow==2.8.1

Operating System

Ubuntu 22.04.3 LTS

Deployment

Official Apache Airflow Helm Chart

Deployment details

No response

What happened

I set the connection as follows:

export AIRFLOW_CONN_AZURE_DEFAULT='azure://<sp-appid>:<sp-secret>?tenantId=<my-tenant>&subscriptionId=<my-subscription>'

As sp-secret is a password, I would assume it is masked from task logs. However, this is not the case.

I see 2 possible reasons:

• There is no concept of hostname (so no @fqdn), which the masking feature might filter on?
• There are special characters in the password field. In my case, the following characters are used: UPPERCASE, lowercase, ~ - _

What you think should happen instead

The log should render:

AIRFLOW_CONN_AZURE_DEFAULT=azure://<sp-appid>:***?tenantId=<my-tenant>&subscriptionId=<my-subscription>'

just like it does with for example postgresql connection.

How to reproduce

Add the connection (does not even need to make sense) as environment variables:

export AIRFLOW_CONN_AZURE_DEFAULT='azure://<sp-appid>:<sp-secret>?tenantId=<my-tenant>&subscriptionId=<my-subscription>'

Create simple DAG to print environment variables

Anything else

I have tried adding a fake hostname x by modifying the string to

export AIRFLOW_CONN_AZURE_DEFAULT='azure://<sp-appid>:<sp-secret>@x?tenantId=<my-tenant>&subscriptionId=<my-subscription>'

This still prints the secret unmasked.

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct