Invalid Configuration Error: OAuthTokenResponse is missing required property 'access_token'

[fivetran-jacklowery]

What happens?

I am trying to create secret following these docs but I am getting an error:
Invalid Configuration Error: OAuthTokenResponse is missing required property 'access_token'

I was able to use PyIceberg and the response body did indeed have access_token so it seems to be an issue with DuckDB. I cannot include my client id/secret but perhaps can share additional details if needed.

To Reproduce

I have been able to use these extensions in the past but when upgrading 1.3.2 it seems as if the access_token is not found.

AI says "The DuckDB C++ code, specifically the part responsible for making the HTTP call and parsing the OAuth2 response, is failing."

INSTALL iceberg;
INSTALL httpfs;
LOAD iceberg;
LOAD httpfs;

CREATE SECRET iceberg_secret (
  TYPE ICEBERG,
  CLIENT_ID 'your_id',
  CLIENT_SECRET 'your_secret',
  OAUTH2_SERVER_URI 'http://irc_host_url.com/v1/oauth/tokens'
);

OS:

macOS Sequoia 15.5

DuckDB Version:

1.3.2

DuckDB Client:

DBeaver

Hardware:

No response

Full Name:

Jack Lowery

Affiliation:

Fivetran

What is the latest build you tested with? If possible, we recommend testing with the latest nightly build.

I have tested with a stable release

Did you include all relevant data sets for reproducing the issue?

Not applicable - the reproduction does not require a data set

Did you include all code required to reproduce the issue?

• Yes, I have

Did you include all relevant configuration (e.g., CPU architecture, Python version, Linux distribution) to reproduce the issue?

• Yes, I have

[Tmonster]

Hi,

Thanks for filing the issue. Can you tell us what provider you are using for Oauth? We will have a hard time reproducing this error/finding the root cause otherwise. Can you also run run the attach with logging enabled and let us know what the response looks like? Friendly reminder to redact any sensitive information from the logs.

``sql
pragma enable_logging('HTTP');
-- ATTACH statement
select * from duckdb_logs_parsed('HTTP');
-- request and response information

[fivetran-jacklowery]

Hi @Tmonster -

I am unable to get to the attach statement because the create secret produces a bad request (400).

I will see if I can get the answer to the OAuth provider question.

We are able to workaround the issue by generating a token in postman / PyIceberg and then using that token when attaching catalog.

[Tmonster]

Ok, would I be able to reproduce this myself using a 5tran iceberg catalog?

If so, I may be able to debug it from my end

[fivetran-jacklowery]

I can give you temporary credentials to a dev catalog.. How would you like me to share these credentials?

[backed-by-data]

Ok, would I be able to reproduce this myself using a 5tran iceberg catalog?

If so, I may be able to debug it from my end

@Tmonster Yes, I’m seeing the same thing right now.

[backed-by-data]

Did some more testing and found it works on DuckDB v1.3.0, only if I set the Polaris secret endpoint to https://polaris.fivetran.com/api/catalog

[Tmonster]

@fivetran-jacklowery
I tried setting up a fivetran catalog the other day that was GCS backed and was having issues connecting the fivetran catalog to GCS. Maybe it's better if you share dev credentials? You can send them to my email at tom@duckdblabs.com

[Tmonster]

Quick update on this, I've seen this error pop up once before, but only when attempting to query a rest catalog from duckdb-iceberg in WASM. The problem in this case is that the Rest catalog does not have a cors policy so the the response fro the rest catalog is not a normal IRC response, but rather a response that CORS has been violated or so, and that's why you don't get an access token.

Maybe this is the issue you are experiencing?

[fivetran-jacklowery]

I guess it is possible I am not sure how to test that. This issue is becoming urgent as the workaround to generate an access token with other tools (e.g. Postman) is not scalable. What else can I do to help? Thank you @Tmonster

[quanvuminh]

@fivetran-jacklowery I encoutered this error then found your posted issue. However, after a few hours playing arround, I've figured out that because I used HTTP scheme with OAUTH2_SERVER_URI while it is automatically redirected to HTTPS. After switched to use HTTPS, it works now. Don't know if it's your case, just want to share.