{"record":{"id":"0b3ca65b8bd29e74","repo":"microsoft/aspire","slug":"aspireradius051","errorCode":"ASPIRERADIUS051","errorMessage":"Secret store '{store.Name}' of type '{store.Type.ToRadiusTypeString()}' is referenced as a {DescribeKind(consumer.Kind)} consumer, which requires a '{RadiusSecretStoreType.BasicAuthentication.ToRadiusTypeString()}' store. Diagnostic: ASPIRERADIUS051.","messagePattern":"Secret store '(.+?)' of type '(.+?)' is referenced as a (.+?) consumer, which requires a '(.+?)' store\\. Diagnostic: ASPIRERADIUS051\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs","lineNumber":251,"sourceCode":"\n            foreach (var consumer in annotation.Consumers)\n            {\n                ValidateConsumer(consumer);\n            }\n        }\n    }\n\n    private static void ValidateConsumer(RadiusSecretStoreConsumer consumer)\n    {\n        var store = consumer.Store;\n\n        // ASPIRERADIUS051 — a Bicep private-registry auth consumer references a basicAuthentication\n        // (username/password) store, matching the OCI registry credential shape. envSecrets can source\n        // from any type, so it is unconstrained here (its per-key check is below).\n        if (consumer.Kind == RadiusSecretStoreConsumerKind.BicepRegistryAuth &&\n            store.Type != RadiusSecretStoreType.BasicAuthentication)\n        {\n            throw new InvalidOperationException(\n                $\"Secret store '{store.Name}' of type '{store.Type.ToRadiusTypeString()}' is referenced as a \" +\n                $\"{DescribeKind(consumer.Kind)} consumer, which requires a '{RadiusSecretStoreType.BasicAuthentication.ToRadiusTypeString()}' store. \" +\n                \"Diagnostic: ASPIRERADIUS051.\");\n        }\n\n        // ASPIRERADIUS051 — a Terraform Git PAT consumer references a store that must expose a 'pat' key\n        // (optionally with 'username'); this is the shape Radius reads for\n        // recipeConfig.terraform.authentication.git.pat, and it is typically a 'generic' store — NOT a\n        // basicAuthentication (username/password) store, whose 'password' key Radius never consumes here.\n        // See https://docs.radapp.io/guides/recipes/terraform/howto-private-registry/. Only enforce when\n        // the store declares its keys inline/explicitly; an existing/sealed store that materializes keys\n        // out-of-band is left unchecked (consistent with the envSecrets keyless handling below).\n        if (consumer.Kind == RadiusSecretStoreConsumerKind.TerraformGitPat)\n        {\n            var declaredKeys = store.Population.HasInlineData\n                ? store.Population.Data.Keys.ToList()\n                : store.Population.Keys;\n","sourceCodeStart":233,"sourceCodeEnd":269,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs#L233-L269","documentation":"Thrown for ASPIRERADIUS051 when a Bicep private-registry auth consumer references a secret store whose type is not BasicAuthentication. Bicep registry authentication expects username/password credentials matching the OCI registry credential shape, which only a basicAuthentication store provides. envSecrets consumers are unconstrained, so this only applies to the BicepRegistryAuth consumer kind.","triggerScenarios":"Registering a consumer with Kind == RadiusSecretStoreConsumerKind.BicepRegistryAuth against a store whose RadiusSecretStoreType is anything other than BasicAuthentication (e.g. a generic store). Detected in ValidateConsumer.","commonSituations":"Pointing Bicep registry auth at a generic store that holds the password as a single key; reusing an existing generic envSecrets store for registry auth; forgetting to change the store type after switching a consumer from envSecrets to registry auth.","solutions":["Change the referenced store's type to RadiusSecretStoreType.BasicAuthentication (username/password).","Create a new basicAuthentication store populated with the registry username/password and point the consumer at it instead.","If the credentials must live in a generic store, reference them differently (e.g. as envSecrets) rather than as registry auth."],"exampleFix":"// before\nvar store = radius.AddSecretStore(\"registry\", t => t.WithType(RadiusSecretStoreType.Generic))...;\nregistryAuth.WithSecretStore(store);\n\n// after\nvar store = radius.AddSecretStore(\"registry\", t => t.WithType(RadiusSecretStoreType.BasicAuthentication))\n    .WithData(\"username\", user).WithData(\"password\", pass);\nregistryAuth.WithSecretStore(store);","handlingStrategy":"validation","validationCode":"bool SupportsRegistryAuth(RadiusSecretStoreResource store, RadiusSecretStoreConsumer consumer) =>\n    consumer.Kind != RadiusSecretStoreConsumerKind.BicepRegistryAuth || store.Type == RadiusSecretStoreType.BasicAuthentication;","typeGuard":null,"tryCatchPattern":"try { ValidateConsumers(...); } catch (InvalidOperationException ex) when (ex.Message.Contains(\"ASPIRERADIUS051\")) { /* re-point consumer at a basicAuthentication store */ }","preventionTips":["Keep one dedicated basicAuthentication store for Bicep registry auth.","Do not reuse generic envSecrets stores as registry-auth sources.","Validate store/consumer wiring in unit tests before deploy."],"tags":["radius","secrets","bicep","type-mismatch"],"backgroundTag":"incompatible-source-type","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}